Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Fix gce util script for getting PREEXISTING_NETWORK_MODE
**What this PR does / why we need it**:
Using `x_gcloud_subnet_mode` seems return nothing and broke the custom network cleanup logic, causing [pull-kubernetes-e2e-gce-gpu](https://k8s-testgrid.appspot.com/kubernetes-presubmits#pull-kubernetes-e2e-gce-gpu) constantly leaking network resource.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes https://github.com/kubernetes/test-infra/issues/5019
**Special notes for your reviewer**:
/assign @bowei
cc @jingax10 @krzyzacy @mindprince
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Provide aggregated validation errors for version and kind
Currently the validation checks is done individually for version and
kind group. For example, if user provided yaml file is missing apiVersion
and kind fields, first they will receive error on apiVersion. Once user
update the file and try to recreate, an error on missing kind is displayed.
The behavior is same for wrong types of the fields.
These errors should be aggregated and displayed.
Examples of current validation:
1
test.yaml is missing apiVersion and kind:
$kubectl.sh create -f /home/sahdev/go/src/bugfixes/test.yaml
error: error validating "/home/sahdev/go/src/bugfixes/test.yaml": error validating data: apiVersion not set; if you choose to ignore these errors, turn validation off with --validate=false
2.
test.yaml is fixed for apiVersion but missing kind:
$kubectl.sh create -f /home/sahdev/go/src/bugfixes/test.yaml
error: error validating "/home/sahdev/go/src/bugfixes/test.yaml": error validating data: kind not set; if you choose to ignore these errors, turn validation off with --validate=false
Examples with aggregated validation:
1.
error: error validating "/home/sahdev/go/src/bugfixes/test.yaml": error validating data: [apiVersion not set, kind not set]; if you choose to ignore these errors, turn validation off with --validate=false
2.
error: error validating "/home/sahdev/go/src/bugfixes/testmix.yaml": error validating data: [apiVersion isn't string type, kind not set]; if you choose to ignore these errors, turn validation off with --validate=false
**What this PR does / why we need it**:
To provide aggregated validations to user for version and kind group.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes#54098
**Special notes for your reviewer**:
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue (batch tested with PRs 54040, 52503). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Get fallback termination msg from docker when using journald log driver
**What this PR does / why we need it**:
When using the legacy docker container runtime and when a container has `terminationMessagePolicy=FallbackToLogsOnError` and when docker is configured with a log driver other than `json-log` (such as `journald`), the kubelet should not try to get the container's log from the json log file (since it's not there) but should instead ask docker for the logs.
**Which issue this PR fixes** fixes#52502
**Special notes for your reviewer**:
**Release note**:
```release-note
Fixed log fallback termination messages when using docker with journald log driver
```
Automatic merge from submit-queue (batch tested with PRs 54040, 52503). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
falls back to parse Docker runtime version as generic if not semver
**What this PR does / why we need it**:
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes#54039
**Special notes for your reviewer**:
/assign @tallclair @vishh
**Release note**:
```release-note
falls back to parse Docker runtime version as generic if not semver
```
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
staging README: update code-generator to published
The code-generator repository has been published long back.
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Do not remove kubelet labels during startup
Fixes#54070
```release-note
kubelet: prevent removal of default labels from Node API objects on startup
```
Currently the validation checks is done individually for version and
kind group. For example, if user provided yaml file is missing apiVersion
and kind fields, first they will receive error on apiVersion. Once user
update the file and try to recreate, an error on missing kind is displayed.
The behavior is same for wrong types of the fields.
These errors should be aggregated and displayed.
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Clean up kublet secret and configmap unit test
**What this PR does / why we need it**:
These changes are clean-up items to fix confusing code encountered while investigating #52043. No actual bugs are fixed here (except, maybe, correcting unit tests that had actual/expected swapped).
A summary of the changes, as listed in the commit:
* Expected value comes before actual value in assert.Equal()
* Use `assert.Equal()` instead of `assert.True()` when possible
* Add a unit test that verifies no-op pod updates to the `secret_manager` and the `configmap_manager`
* Add a clarifying comment about why it's good to seemingly delete a secret on updates.
* Fix (for now, non-buggy) variable shadowing issue
**Special notes for your reviewer**:
N/A
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue (batch tested with PRs 51416, 53535). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
PodSecurityPolicy: teach fuzzer about fsGroup/supplementalGroups strategies
**What this PR does / why we need it**:
At present, fuzzer for PSP doesn't take into account `fsGroup`/`supplementalGroups` strategies. This PR teach fuzzer about these strategies in order to have ability to catch more possible errors.
**Special notes for your reviewer**:
Let me know if you think that we need to cover more (all?) fields in the PSP.
**Release note**:
```release-note
NONE
```
PTAL @pweil- @sttts
CC @simo5
Automatic merge from submit-queue (batch tested with PRs 54036, 53739). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
admission_test.go: remove unused functions
**What this PR does / why we need it**:
PR removed unused `createNamespaceForTest()` and `createSAForTest()` functions from `admission_test.go`.
**Release note**:
```release-note
NONE
```
PTAL @liggitt @pweil-
CC @simo5
Automatic merge from submit-queue (batch tested with PRs 54036, 53739). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Remove Sprintf when there are no placeholders in the formatting.
**What this PR does / why we need it**:
Minor cleanup.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
**Special notes for your reviewer**:
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Duplicate a constant - LabelNodeRoleMaster
**What this PR does / why we need it**:
Per request from @luxas in 53458, to avoid cmd/kubeadm to
depend on pkg/controller/service. Added a comment to make
this clear.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
**Special notes for your reviewer**:
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue (batch tested with PRs 53978, 54008, 53037). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Change scheduler to skip pod with updates only on pod annotations
Fixes#52914, by checking whether the pod is already assumed before scheduling it.
**Release note**:
```
Scheduler cache ignores updates to an assumed pod if updates are limited to pod annotations.
```
/sig scheduling
/assign @bsalamat
/cc @vishh
Automatic merge from submit-queue (batch tested with PRs 53978, 54008, 53037). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Fix expected result in Custom Metrics - Stackdriver Adapter e2e test
**What this PR does / why we need it**:
This PR fixes a bug in e2e tests for Custom Metrics - Stackdriver Adapter
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
fix typos: remove duplicated word in comments
**What this PR does / why we need it**: Remove the duplicated word `the` in comments
**Which issue this PR fixes** : fixes #
**Special notes for your reviewer**:
```release-note
NONE
```
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
fix kubemark, juju, and libvirt-coreos README (from minions to nodes)
**What this PR does / why we need it**:
This PR will fix old name(minison) to new name(node) in kubemark README.md.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
**Special notes for your reviewer**:
**Release note**:
```release-note
```
Automatic merge from submit-queue (batch tested with PRs 53575, 53794). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Add e2e test case for downward API exposing pod UID
**What this PR does / why we need it**:
Pod UID is added to downward API env var in #48125 for 1.8. This PR adds a e2e test case for it.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
ref: #48125
**Special notes for your reviewer**:
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
remove repeated type conversion
**What this PR does / why we need it**:
remove repeated type conversion(convert String to Feature)
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
we just need make this conversion once.
**Special notes for your reviewer**:
**Release note**:
```release-note
NONE
```
Go 1.9 has some better checks for SAN extensions, notably:
630e93ed2d
We recently added ServerName to the rest client TLSConfig:
186a0684d5 (diff-eb3573c6b11347dc3793c477726480efR262)
So we need to be sure that the ServerName "webhook-test.default.svc" is
present in the certificates that we generate."
Automatic merge from submit-queue (batch tested with PRs 48665, 52849, 54006, 53755). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Add named-port ingress test
**What this PR does / why we need it**:
Validate correct behavior when a `NetworkPolicyIngressRule` refers to a named port rather than a numerical port, e.g. `serve-80` rather than `80`.
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue (batch tested with PRs 48665, 52849, 54006, 53755). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
start generating rbac serialization for v1
At some point we lost our protobuf generation for rbac/v1. This adds it back.
Automatic merge from submit-queue (batch tested with PRs 48665, 52849, 54006, 53755). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Order PSP by name, prefer non-mutating PSPs
Fixes#36184Fixes#23217
Related to #23217
Removes unnecessary mutation of pods:
* Determines effective security context for pods using a wrapper containing the pod and container security context, rather than building/setting a combined struct on every admission
* Does not set `privileged:&false` on security contexts with `privileged:nil`
* Does not set `runAsNonRoot:&true` on security contexts that already have a non-nil, non-0 `runAsUser`
* Does not mutate/normalize container capabilities unless changes are required (missing defaultAddCapabilities or requiredDropCapabilities)
Defines behavior when multiple PSP objects allow a pod:
* PSPs which allow the pod as-is (no defaulting/mutating) are preferred
* If the pod must be defaulted/mutated to be allowed, the first PSP (ordered by name) to allow the pod is selected
* During update operations, when mutations to pod specs are disallowed, only non-mutating PSPs are used to validate the pod
```release-note
PodSecurityPolicy: when multiple policies allow a submitted pod, priority is given to ones which do not require any fields in the pod spec to be defaulted. If the pod must be defaulted, the first policy (ordered by name) that allows the pod is used.
```
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Add missing short names to kubectl help text
**What this PR does / why we need it**:
This PR adds two short names that exist but are not listed in the help text that `kubectl get` produces.
**Special notes for your reviewer**:
🍰
**Release note**:
```release-note
NONE
```
Kubernetes Submit Queue