Automatic merge from submit-queue

Update kubectl to stable version for Addon Manager

Bumps up Addon Manager to v6.2, below images are pushed:
- gcr.io/google-containers/kube-addon-manager:v6.2
- gcr.io/google-containers/kube-addon-manager-amd64:v6.2
- gcr.io/google-containers/kube-addon-manager-arm:v6.2
- gcr.io/google-containers/kube-addon-manager-arm64:v6.2
- gcr.io/google-containers/kube-addon-manager-ppc64le:v6.2
- gcr.io/google-containers/kube-addon-manager-s390x:v6.2

@mikedanese 

cc @ixdy

Automatic merge from submit-queue (batch tested with PRs 39803, 39698, 39537, 39478)

[scheduling] Moved pod affinity and anti-affinity from annotations to api fields #25319

Converted pod affinity and anti-affinity from annotations to api fields

Related: #25319
Related: #34508

**Release note**:
```Pod affinity and anti-affinity has moved from annotations to api fields in the pod spec.  Pod affinity or anti-affinity that is defined in the annotations will be ignored.```

Automatic merge from submit-queue (batch tested with PRs 39803, 39698, 39537, 39478)

include bootstrap admin in super-user group, ensure tokens file is correct on upgrades

Fixes https://github.com/kubernetes/kubernetes/issues/39532

Possible issues with cluster bring-up scripts:

- [x] known_tokens.csv and basic_auth.csv is not rewritten if the file already exists
  * new users (like the controller manager) are not available on upgrade
  * changed users (like the kubelet username change) are not reflected
  * group additions (like the addition of admin to the superuser group) don't take effect on upgrade
  * this PR updates the token and basicauth files line-by-line to preserve user additions, but also ensure new data is persisted
- [x] existing 1.5 clusters may depend on more permissive ABAC permissions (or customized ABAC policies). This PR adds an option to enable existing ABAC policy files for clusters that are upgrading

Follow-ups:
- [ ] both scripts are loading e2e role-bindings, which only be loaded in e2e tests, not in normal kube-up scenarios
- [ ] when upgrading, set the option to use existing ABAC policy files
- [ ] update bootstrap superuser client certs to add superuser group? ("We also have a certificate that "used to be" a super-user. On GCE, it has CN "kubecfg", on GKE it's "client"")
- [ ] define (but do not load by default) a relaxed set of RBAC roles/rolebindings matching legacy ABAC, and document how to load that for new clusters that do not want to isolate user permissions

Automatic merge from submit-queue (batch tested with PRs 39803, 39698, 39537, 39478)

default a CSR's allowed usage to key encipherment and digital signing

Some pretty safe and sane defaults.

@liggitt

Automatic merge from submit-queue (batch tested with PRs 39803, 39698, 39537, 39478)

Use controller interface for everything in config factory

**What this PR does / why we need it**:

We want to replace controller structs with interfaces 
- per the TODO in `ControllerInterface`
- Specifically this will make the decoupling from Config and reuse of the scheduler's subcomponents cleaner.

Automatic merge from submit-queue (batch tested with PRs 39661, 39740, 39801, 39468, 39743)

enable psp by default

Enable the extensions/psp resource by default

**Release note**:
```release-note
PodSecurityPolicy resource is now enabled by default in the extensions API group.
```

Automatic merge from submit-queue (batch tested with PRs 39661, 39740, 39801, 39468, 39743)

fix nodeStatusUpdateRetry count exceeding condition judgement

When tryUpdateNodeStatus() return err,err!=nil,  but nc.kubeClient.Core().Nodes().Get() return no err, err==nil,
And we run nodeStatusUpdateRetry times, when for loop ends, err == nil, we can not print error info and run continue, so maybe the condition judgement is not right
Maybe caused #38671

Automatic merge from submit-queue (batch tested with PRs 39661, 39740, 39801, 39468, 39743)

update heapster version to 1.3.0-beta.0

Automatic merge from submit-queue (batch tested with PRs 39661, 39740, 39801, 39468, 39743)

add --controllers to controller manager

Adds a `--controllers` flag to the `kube-controller-manager` to indicate which controllers are enabled and disabled.  From the help:

```
      --controllers stringSlice                                           A list of controllers to enable.  '*' enables all on-by-default controllers, 'foo' enables the controller named 'foo', '-foo' disables the controller named 'foo'.
All controllers: certificatesigningrequests, cronjob, daemonset, deployment, disruption, endpoint, garbagecollector, horizontalpodautoscaling, job, namespace, podgc, replicaset, replicationcontroller, resourcequota, serviceaccount, statefuleset
```

Automatic merge from submit-queue

fix redundant alias clientset

remove redundant alias clientset

fields. #25319

Automatic merge from submit-queue

Refactor registry etcd to storage

Fixes #17546 

Simple shuffle on naming so any sane new person entering the code base can understand what the actual etcd dependencies are.

Automatic merge from submit-queue

move tunneler out of generic

moves the tunneler out of genericapiserver and under master where its used.

@sttts

Revert "Add e2e test for external pv provisioning"

When tryUpdateNodeStatus() return err,err!=nil,  but nc.kubeClient.Core().Nodes().Get() return no err, err==nil,
And we run nodeStatusUpdateRetry times, when for loop ends, err == nil, we can not print error info and run continue, so the condition judgement is wrong.

Automatic merge from submit-queue (batch tested with PRs 39773, 39739)

Fixed cluster validation in e2e tests for HA master.

Automatic merge from submit-queue (batch tested with PRs 39773, 39739)

Wait until kubernetes-src.tar.gz is built before building node/server.

**What this PR does / why we need it**: both the server and node release tarballs depend on kubernetes-src.tar.gz, but we weren't waiting for it to exist. how this ever worked is a mystery to me.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/test-infra/pull/1546#issuecomment-272024058

**Release note**:

```release-note
NONE
```

Automatic merge from submit-queue (batch tested with PRs 37557, 39545)

Add e2e test for external pv provisioning

fixes https://github.com/kubernetes/kubernetes/issues/36170

Automatic merge from submit-queue

Update ugorji/go/codec godep

In order to pick-up https://github.com/ugorji/go/issues/119 and to get rid of the workaround at https://github.com/kubernetes/kubernetes/pull/36909/files#diff-a09eb061a0fb0ef3c9ef9d696f1ad0b4R426.

Automatic merge from submit-queue

proxy/iptables: don't sync proxy rules if services map didn't change

Build the service map in a separate testable function.  Return that map instead of changing proxier.serviceMap directly.  Use reflect.DeepEqual() to skip syncing proxy rules if nothing actually changed.

@thockin @kubernetes/rh-networking @kubernetes/sig-network-misc @timothysc @wojtek-t @jeremyeder @caseydavenport

Automatic merge from submit-queue (batch tested with PRs 39768, 39463)

modify Umask() and delete ErrorTimeout function

ErrorTimeout() is never used,remove it. And modify Umask() args

Automatic merge from submit-queue (batch tested with PRs 39768, 39463)

Check if path exists before performing unmount

This is part 3 of an effort to check if path exists before performing an unmount operation.
[Part 1](https://github.com/kubernetes/kubernetes/pull/38547) and [part 2](https://github.com/kubernetes/kubernetes/pull/39311) involved auditing the different volume plugins and refactoring their `TearDownAt()s` to use the common util function/or create one if absent.

The ideal way to do this change would involve refactoring of the `TearDownAt()s` of these plugins and make a common util function that checks path. (The plugins involved in this PR use someway of unmounting a bind mount and unmounting a global path, there is also refactoring needed to consolidate disk_manager of fc, rbd and iscsi). A non-goal part of this effort can also involve refactoring all the `SetupAt()s`

In the interest of time and considering other higher priority issues that I am caught up with, I am unable to give the time the refactoring needs. Hence I've made the minimum change that would give the desired output.

I am tracking the work pending in this issue: https://github.com/kubernetes/kubernetes/issues/39251

```release-note
NONE
```

Automatic merge from submit-queue

Fix bug when printing replicas in Deployment Describer

Deployment describer is printing replicas using pointer instead of integer. This bug is introduced by #36673 which updates the describer to use versioned API. cc @caesarxuchao 

Fixes #38697

Automatic merge from submit-queue (batch tested with PRs 39171, 39771)

remove BUILD spammy output

leftover from debugging

Automatic merge from submit-queue

Add [Volume] tag to all the volume-related E2E tests.

**What this PR does / why we need it**:
Tags all the volume/storage related e2e tests to make it easier to run a volume test suite.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
fixes #35542 

**Special notes for your reviewer**:
Please let me know if there are tests that should/should not be included.

**Release note**:
NONE
```release-note
```

ErrorTimeout is never used

Revert "controller: unit tests for overlapping and recreate deployments"