Automatic merge from submit-queue

e2e: Fix GetReadySchedulableNodesOrDie for taints

**What this PR does / why we need it**:

This changes framework.GetReadySchedulableNodesOrDie and
framework.GetMasterAndWorkerNodesOrDie so that nodes that can't take a
generic fake pod due to a taint/toleration mismatch aren't returned.

This is a rehash of #35210, but pulls in the scheduler code.

**Which issue this PR fixes**: c.f. #35210

**Special notes for your reviewer**: I think it's gross that we keep having to manually compute this in e2es. Maybe we need a bug for that?

Automatic merge from submit-queue

Migrate Network Logic into runtime II

- [x] Probing
- [x] Bootstrap CIDR
- [x] Setup/Teardown
- [ ] ~~Hostports~~
- [ ] ~~BWShaping~~

https://github.com/kubernetes/kubernetes/pull/34780

Automatic merge from submit-queue

Eviction manager evicts based on inode consumption

Fixes: #32526 Integrate Cadvisor per-container inode stats into the summary api.  Make the eviction manager act based on inode consumption to evict pods using the most inodes.

This PR is pending on a cadvisor godeps update which will be included in PR #35136

This changes framework.GetReadySchedulableNodesOrDie and
framework.GetMasterAndWorkerNodesOrDie so that nodes that can't take a
generic fake pod due to a taint/toleration mismatch aren't returned.

This is a rehash of #35210, but pulls in the scheduler code.

Automatic merge from submit-queue

Add tooling to generate listers

Add lister-gen tool to auto-generate listers. So far this PR only demonstrates replacing the manually-written `StoreToLimitRangeLister` with the generated `LimitRangeLister`, as it's a small and easy swap.

cc @deads2k @liggitt @sttts @nikhiljindal @lavalamp @smarterclayton @derekwaynecarr  @kubernetes/sig-api-machinery @kubernetes/rh-cluster-infra

Automatic merge from submit-queue

Only set sysctls for infra containers

We did set the sysctls for each container in a pod. This opens up a way to set un-whitelisted sysctls during upgrade from v1.3:
- set annotation in v1.3 with an un-whitelisted sysctl. Set restartPolicy=Always
- upgrade cluster to v1.4
- kill container process
- un-whitelisted sysctl is set on restart of the killed container.

Fix density test in large clusters

Automatic merge from submit-queue

kubeadm: lower default component logging level

v=4 is likely to causer perf issues and v=2 is the default in most other setups including scale e2e. ref https://github.com/kubernetes/kubernetes/issues/26637#issuecomment-256859739

Automatic merge from submit-queue

remove non-reuseable bits of MasterServer

Scrub `master.go` again.  I think I'm pretty happy with this shape.  I may promote `InstallAPIs` since we're likely to want it downstream.

Automatic merge from submit-queue

SELinux Overhaul

Overhauls handling of SELinux in Kubernetes.  TLDR: Kubelet dir no longer has to be labeled `svirt_sandbox_file_t`.

Fixes #33351 and #33510.  Implements #33951.

Automatic merge from submit-queue

Add SNI support to the apiserver

This PR adds the `--tls-sni-key-cert` flag to the apiserver. It can be passed multiple times in the following ways:

``` shell
$ apiserver \
    --tls-sni-cert-key '*.example.com,example.com: example.key,example.crt' \
    --tls-sni-cert-key 'foo.key,foo.crt'
```

The first variant explicitly sets the accepted domain names, the second variant reads the common names and DNS names from the certificate itself.

If no domain name matches, the existing certificate (`--tls-cert-file`) is used.

``` golang
    fs.Var(config.NewNamedCertKeyArray(&s.SNICertKeys), "tls-sni-cert-key", ""+
        "A pair of x509 certificate and private key file paths, optionally prefixed with a list of "+
        "domain patterns which are fully qualified domain names, possibly with prefixed wildcard "+
        "segments. If no domain patterns are provided, the names of the certificate are "+
        "extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns "+
        "trump over extracted names. For multiple key/certificate pairs, use the "+
        "--tls-sni-key-cert multiple times. "+
        "Examples: \"example.key,example.crt\" or \"*.foo.com,foo.com:foo.key,foo.crt\".")
```

``` release-note
Add SNI support to the apiserver

Pass multiple certificates and domain name patterns with `--tls-sni-cert-key` and the right certificate will be chosen depending on the url the client is using.
```

Automatic merge from submit-queue

Remove archived clientset

We have [client-go](https://github.com/kubernetes/client-go) now, no need to keep archived clientset in master of k8s.io/kubernetes.

Also updated the client-gen README.

Fix https://github.com/kubernetes/kubernetes/issues/35803.

cc @mikedanese 

```release-note
The main kubernetes repository stops hosting archived version of released clients. Please use [client-go](https://github.com/kubernetes/client-go).
```

Automatic merge from submit-queue

break endless loop in vagrant cluster

reference to [vagrant.md](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/local-cluster/vagrant.md) troubleshooting ,  I guess we could set a time to return from endless loop to register with cloud provider.

Automatic merge from submit-queue

Correct the article in generated documents

**What this PR does / why we need it**:
Fix the article in generated docs for "create/delete [article] [kind]"

**Which issue this PR fixes**
fixes #32305

**Special notes for your reviewer**:
None

**Release note**:

``` release-note
Correct the article in generated documents
```

For example:
  "a Ingress" > "an Ingress"

Automatic merge from submit-queue

Alternative unsafe copy

Have run this for 2 hours in the stresser without an error (no guarantee).

@wojtek-t can we do a 500 kubemark run with this prior to merge?

Automatic merge from submit-queue

Update PodAntiAffinity to ignore calls to subresources

@smarterclayton I hit this when I was trying to evict a pod, apparently k8s does not have this particular admission plugin on by default. ptal

@mml @davidopp fyi

Automatic merge from submit-queue

Allow apiserver to choose preferred kubelet address type

Follow up to #33718 to stay compatible with clusters using DNS names for master->node communications. Adds the `--kubelet-preferred-address-types` apiserver flag for clusters that prefer a different node address type.

```release-note
The apiserver can now select which type of kubelet-reported address to use for master->node communications, using the --kubelet-preferred-address-types flag.
```

Automatic merge from submit-queue

Bump rkt stage1-fly to 1.18.0

Bumps stage1-fly version.

Automatic merge from submit-queue

Bump Kubelet workingset upper bound

For https://github.com/kubernetes/kubernetes/issues/34990

Follow up to https://github.com/kubernetes/kubernetes/pull/35828, because working memory is too high now too.

Automatic merge from submit-queue

Improve CockroachDB example

This is primarily about pulling in the init container to make the config more production-ready, but I've pulled in a few other small improvements that have been made since this was first contributed.

* Use an init container to eliminate potential edge case where losing
  the first pet's data could cause it to start a second logical cluster
* Exec the cockroach binary so that it runs as PID 1 in the container
* Make some small improvements to the README

@bprashanth 

```release-note
```

remove archived federation clientsets
update README

Automatic merge from submit-queue

Disable update-staging-client-go until code freeze

I don't want to cause developer friction until code freeze. I'll babysit the script for the moment to keep the client-go up-to-date.

Should had done this in #34489.

Automatic merge from submit-queue

quota controller uses informers if available for pod calculation

This PR does the following:
1. plumb informer factory into quota registry and evaluators
2. pod quota evaluator uses informers for determining aggregrate usage instead of making direct calls
3. admission code path does not use informers because
   1. we do not want to add new watches in apiserver
   2. admission code path does not require aggregate usage calculation

As a result, quota controller is much faster in re-calculating quota usage when it observes a pod deletion.

Follow-on PRs will make similar changes for other informer backed resources (pvcs next).

/cc @deads2k @mfojtik @smarterclayton @kubernetes/rh-cluster-infra