…pick-of-#64383-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#64383: fix azure file size grow issue

Cherry pick of kubernetes#64383 on release-1.10.

kubernetes#64383: fix azure file size grow issue

…f-#62505-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#62505: update godeps to use latest pflag

Cherry pick of kubernetes#62505 on release-1.10.

kubernetes#62505: update godeps to use latest pflag

```release-note
Show help for deprecated Kubelet flags
```

…ck-of-#63303-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#63303: Return attach error to A/D controller.

Cherry pick of kubernetes#63303 on release-1.10.

kubernetes#63303: Return attach error to A/D controller.

```release-note
Fixed error reporting of CSI volumes attachment.
```

Signed-off-by: Lantao Liu <lantaol@google.com>

Signed-off-by: Lantao Liu <lantaol@google.com>

…pick-of-#62670-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#62670: Fix kubelet flags.

Cherry pick of kubernetes#62670 on release-1.10.

kubernetes#62670: Fix kubelet flags.

…ck-of-#64026-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#64026: Add SELinux support to CSI

Cherry pick of kubernetes#64026 on release-1.10.

kubernetes#64026: Add GetSELinuxSupport to mounter.

```release-note
Fixed SELinux relabeling of CSI volumes.
```

…pick-of-#62753-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#62753: Fix extra-log flag for node e2e.

Cherry pick of kubernetes#62753 on release-1.10.

kubernetes#62753: Fix extra-log flag for node e2e.

fix comments

fix comments

fix comments

fix comments

fix comments

…-of-#63770-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#63770: Implement Skip() for ingress upgrade test

Cherry pick of kubernetes#63770 on release-1.10.

kubernetes#63770: Implement Skip() for ingress upgrade test

```release-note
NONE
```

…InUseProtection-downgrade-issue-cherry-pick-into-K8s-1.10

Automatic merge from submit-queue.

cherry-pick into K8s 1.10: Always Start pvc-protection-controller and pv-protection-controller

**What this PR does / why we need it**:
StorageObjectInUseProtection feature is enabled by default in K8s 1.10+. Assume K8s cluster is used with this feature enabled, i.e. finalizers are added to all PVs and PVCs. In case the K8s cluster admin disables the StorageObjectInUseProtection feature and a user deletes a PVC that is not in active use by a pod then the PVC is not removed from the system because of the finalizer. Therefore, the user will have to remove the finalizer manually in order to have the PVC removed from the system. Note: deleted PVs won't be removed from the system also because of finalizers.

This problem was fixed in [K8s 1.9.6](https://github.com/kubernetes/kubernetes/releases/tag/v1.9.6) in PR kubernetes#61370
This problem is also fixed in K8s 1.11+ in PR kubernetes#61324
However, this problem is not fixed in K8s 1.10, that's why I've cherry-picked the PR kubernetes#61324 and proposing to merge it into K8s 1.10.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes 
N/A

Related issue: kubernetes#60764

**Special notes for your reviewer**:

**Release note**:

```release-note
In case StorageObjectInUse feature is disabled and Persistent Volume (PV) or Persistent Volume Claim (PVC) contains a finalizer and the PV or PVC is deleted it is not automatically removed from the system. Now, it is automatically removed.
```

…rry-pick-of-#64519-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#64519: CSI fix for gRPC conn leak, test updates

Cherry pick of kubernetes#64519 on release-1.10.

kubernetes#64519: CSI fix for gRPC conn leak, test updates

```release-note
Fixed CSI gRPC connection leak during volume operations.
```

…-of-#64351-upstream-release-1.10

Automatic merge from submit-queue.

[1.10] Automated cherry pick of kubernetes#64351: Only mount subpath as readonly if specified in volumeMount

Automated cherry pick of kubernetes#64351: Only mount subpath as readonly if specified in volumeMount

**Release note**:

```release-note
Fixes issue for readOnly subpath mounts for SELinux systems and when the volume mountPath already existed in the container image.
```

Signed-off-by: Antonio Murdaca <runcom@redhat.com>

1.10 e2e tests get run against 1.11.0+ masters during upgrade tests.
This fails as Sysctl moved from annotations to fields, so we should
check the version and avoid running these tests.

In 7e158fb, we added a BinaryData
to ConfigMap, but totally forgot to add it to the hash method.

…ck-of-#64797-upstream-release-1.10

Automatic merge from submit-queue.

Skip updating status for DaemonSet being deleted

**What this PR does / why we need it**: kubernetes#64313, kubernetes#64797 (comment)

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Skip updating status for DaemonSet being deleted.
```

…pick-of-#63248-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#63248: fix formatAndMount func issue on Windows

Cherry pick of kubernetes#63248 on release-1.10.

kubernetes#63248: fix formatAndMount func issue on Windows

…ed-sysctl-annotations-to-fields-2

Automatic merge from submit-queue.

Skip Sysctl tests against v1.11.0-alpha.0 and newer

**What this PR does / why we need it**:

1.10 e2e tests get run against 1.11.0+ masters during upgrade tests.
This fails as Sysctl moved from annotations to fields, so we should
check the version and avoid running these tests.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes#64845

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

fix comments

fix comments on unit test

fix comments

We have 2 scenarios where we copy /etc/hosts
- with host network (we just copy the /etc/hosts from node)
- without host network (create a fresh /etc/hosts from pod info)

We are having trouble figuring out whether a /etc/hosts in a
pod/container has been "fixed-up" or not. And whether we used
host network or a fresh /etc/hosts in the various ways we start
up the tests which are:

- VM/box against a remote cluster
- As a container inside the k8s cluster
- DIND scenario in CI where test runs inside a managed container

Please see previous mis-guided attempt to fix this problem at
ba20e63 In this commit we revert
the code from there as well.

So we should make sure:
- we always add a header if we touched the file
- we add slightly different headers so we can figure out if we used the
  host network or not.

Update the test case to inject /etc/hosts from node to another path
(/etc/hosts-original) as well and use that to compare.

…f-#61575-kubernetes#57600-kubernetes#62499-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#61575: Remove all upstream BUILD, BUILD.bazel, and WORKSPACE kubernetes#57600: Vendor gazelle kubernetes#62499: Update kazel to include openapi tag detection fix

Cherry pick of kubernetes#61575 kubernetes#57600 kubernetes#62499 on release-1.10.

kubernetes#61575: Remove all upstream BUILD, BUILD.bazel, and WORKSPACE
kubernetes#57600: Vendor gazelle
kubernetes#62499: Update kazel to include openapi tag detection fix

This is an alternative to kubernetes#64928, and would fix kubernetes#64925.

We can't just cherry-pick kubernetes#57600, since there was a prerequisite PR and a fixup PR afterwards.

…ion webhooks

Unclean cherry-pick.

…ck-of-#64727-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#64727: Update GCE cloud provider to use Cloud TPU v1 API

Cherry pick of kubernetes#64727 on release-1.10.

kubernetes#64727: Update GCE cloud provider to use Cloud TPU v1 API

…ck-of-#58972-kubernetes#63650-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#58972: Fix job's backoff limit for restart policy OnFailure kubernetes#63650: Never clean backoff in job controller

Cherry pick of kubernetes#58972 kubernetes#63650 on release-1.10.

kubernetes#58972: Fix job's backoff limit for restart policy OnFailure
kubernetes#63650: Never clean backoff in job controller

Fixes kubernetes#62382.

**Release Note:**
```release-note
Fix regression in `v1.JobSpec.backoffLimit` that caused failed Jobs to be restarted indefinitely.
```

…ck-of-#63631-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#63631: Add gpu cluster upgrade test.

Cherry pick of kubernetes#63631 on release-1.10.

kubernetes#63631: Add gpu cluster upgrade test.

We added a gpu upgrade test config from 1.9-1.10 (kubernetes/test-infra#8262). From the test logs, looks like the cluster upgrade test is using the e2e test version from the latest 1.10 release which doesn't have the newly added GPUUpgrade test. There doesn't seem to be an easy way to use the e2e test version from a head release while running the upgrade test for older release version. Cherry-picking the upgrade test to 1.10 branch so that we can gpu upgrade test from 1.9 to 1.10.

…ck-of-#64739-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#64739: Fix panic while provisioning Azure security group rules

Cherry pick of kubernetes#64739 on release-1.10.

kubernetes#64739: Fix panic while provisioning Azure security group rules

Only call setup after they are found; otherwise
we are left with orphan directories that are never
cleaned up.

…ck-of-#63977-kubernetes#64672-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#63977: pkg: kubelet: remote: increase grpc client default size kubernetes#64672: pkg: kubelet: remote: increase grpc client default size to

Cherry pick of kubernetes#63977 kubernetes#64672 on release-1.10.

kubernetes#63977: pkg: kubelet: remote: increase grpc client default size
kubernetes#64672: pkg: kubelet: remote: increase grpc client default size to

```release-note
CRI: increase grpc client default size to 16MB
```

…k-removal-1.10

Automatic merge from submit-queue.

Cherry pick of kubernetes#64255: fix field removal in mutating admission webhooks

This cherry-pick was unclean because the webhook plugin was seriously refactored after 1.10

Based on kubernetes#64255

```release-note
Webhooks for the mutating admission controller now support "remove" operation.
```

Automatic merge from submit-queue.

kubeadm - increase upgrade manifest timeout

**What this PR does / why we need it**:

Backports the manifest upgrade timeout from kubernetes#64988 to v1.10

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#850

**Release note**:
```release-note
kubeadm - Increase the manifest upgrade timeout to make upgrades more reliable.
```

…-of-#64503-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#64503: Create system:cluster-autoscaler account & role and

Cherry pick of kubernetes#64503 on release-1.10.

kubernetes#64503: Create system:cluster-autoscaler account & role and

…ttacher

…pick-of-#65035-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#65035 upstream release 1.10

Add kms-plugin-container.sh to release.sh.

```release-note
Due to the mismatch between quick release and bazel release need to manually update release.sh to include kms-plugin-container.manifest in release.sh. Otherwise, when KMS integration is requested kube-apiserver fails to come-up.
```
REF kubernetes#65035

…tertaints

Automatic merge from submit-queue.

Fixed taints being applied to master if NoTaintMaster is true

**What this PR does / why we need it**:

This PR fixes removing the master taint when `noTaintMaster` is true. It will append all current taints to the `taints` variable unless it is a master taint, and then assign `taints` back to the `node.Spec.Taints` property. 

The function currently will add the master taint to the `taints` variable for as many taints as the master has. It will also remove any taints that are on the master. 


```release-note
Fixed NoTaintMaster to remove master taint and keep all other applied taints. 
```

…D PVC stuck on ContainerCreating.

…k-of-#64355-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#64355: bump(github.com/evanphx/json-patch):

Cherry pick of kubernetes#64355 on release-1.10.

kubernetes#64355: bump(github.com/evanphx/json-patch):

Automatic merge from submit-queue.

Add RBAC policy rules for csi-external-provisioner and csi-external-attacher

Adds RBAC Policy rules for `csi-external-provisioner` and `csi-external-attacher` so that CSI drivers can bind to these cluster roles on every version of k8s where CSI is Beta or above.

These roles were added in 1.11 but never cherrypicked back to 1.10. The roles originally added as a part of a larger change here: kubernetes#61866

 I could not do a direct cherry-pick because some of the RBAC primitives changed and there was also a fix applied on top with this PR:
kubernetes#65070
The fix has been included in this commit. 

/kind enhancement
/sig storage
/cc @msau42 
/assign @liggitt @MaciekPytel

```release-note
NONE
```

…k-of-#64855-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#64855: Fix setup of configmap/secret/projected/downwardapi

Cherry pick of kubernetes#64855 on release-1.10.

kubernetes#64855: Fix setup of configmap/secret/projected/downwardapi

```release-note
Fix setup of configmap/secret/projected/downwardapi volumes
```

… Unstructured

The list+get endpoints sets the self-link. If we do not create a (shallow)
copy of ObjectMeta this will mutate the cached objects.

Under following conditions session affinity leads to a deadlock:
  - Self hosted controller-manager, where it talks to API servers
    via kubernetes service ClusterIP
  - default master-count reconcilier is used
  - --apiserver-count is set to >1 according to the help message
  - number of responsive APIServers goes below `apiserver-count`
  - all controller-managers happen to be hashed to APIServers which
    are down.

What then happens is that controller managers never be able to
contact APIServer, despite correctly working APIServer available.

Less serious outages also possible for other consumers of kubernetes
service, such as operators, kube-dns, flannel & calico, etc.  There is
always non zero chance, that given consumer is hashed  to an apiserver
which is down.

Revert "give the kubernetes service client ip session affinity"
This reverts commit e21ebbc.

…ick-of-#64630-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#64630: Wait a minimum amount of time for polling operations

Cherry pick of kubernetes#64630 on release-1.10.

kubernetes#64630: Wait a minimum amount of time for polling operations

…4-1.10

Automatic merge from submit-queue.

Manually cherrypick kubernetes#65034 to 1.10

Manually cherrypicking kubernetes#65034. Using hack/cherry_pick_pull.sh to cherrypick is difficult because that requires cherrypicking kubernetes#63059 first.

This PR imported the latest jsoniterator library so that case sensitivity during unmarhsaling is optional. The PR also set Kubernetes json serializer to be case sensitive.

Fix kubernetes#64612.

```release-notes
Kubernetes json deserializer is now case-sensitive to restore compatibility with pre-1.8 servers.
If your config files contains fields with wrong case, the config files will be now invalid.
```

…ntiaffinity_for_1_10

Automatic merge from submit-queue.

[backport] Disable session affinity for internal kubernetes service

Under following conditions session affinity leads to a deadlock:
  - Self hosted controller-manager, where it talks to API servers
    via kubernetes service ClusterIP
  - default master-count reconcilier is used
  - --apiserver-count is set to >1 according to the help message
  - number of responsive APIServers goes below `apiserver-count`
  - all controller-managers happen to be hashed to APIServers which
    are down.

What then happens is that controller managers never be able to
contact APIServer, despite correctly working APIServer available.

Less serious outages also possible for other consumers of kubernetes
service, such as operators, kube-dns, flannel & calico, etc.  There is
always non zero chance, that given consumer is hashed  to an apiserver
which is down.

Revert "give the kubernetes service client ip session affinity"
This reverts commit e21ebbc.

**What this PR does / why we need it**:
Backporting kubernetes#56690 to 1.10 release branch.

**Which issue(s) this PR fixes** 
Fixes kubernetes#23129

**Release note**:
```release-note
Disable session affinity for internal kubernetes service - Backport of kubernetes#56690 to 1.10 release branch
```

…ck-of-#64588-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#64588: Fix some log issues in flexvolume

Cherry pick of kubernetes#64588 on release-1.10.

kubernetes#64588: Fix some log issues in flexvolume

…k-of-#65339-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#65339: Remove item from taint manager workqueue on completion

Cherry pick of kubernetes#65339 on release-1.10.

kubernetes#65339: Remove item from taint manager workqueue on completion

…-of-#65176-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#65176: Pass cluster_location argument to Heapster

Cherry pick of kubernetes#65176 on release-1.10.

kubernetes#65176: Pass cluster_location argument to Heapster

…29.2

Automatic merge from submit-queue.

Update cadvisor godeps to v0.29.2

**What this PR does / why we need it**:
This updates the cAdvisor godeps from v0.29.1 to v0.29.2 to incorporate a number of important bug-fixes.

**Release note**:
```release-note
Fix concurrent map access panic
Don't watch .mount cgroups to reduce number of inotify watches
Fix NVML initialization race condition
Fix brtfs disk metrics when using a subdirectory of a subvolume
```
/assign @dchen1107
for lgtm
/assign @MaciekPytel
for milestone, milestone approval, and cherrypick-approval

…k-of-#65415-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#65424: Fix scheduler config decoding

Cherry pick of kubernetes#65424 on release-1.10.

kubernetes#65424: Fix scheduler config decoding

Reuse leases for keys in a time window, to reduce the overhead to etcd
caused by using massive number of leases

Fixes kubernetes#47532

When a pod is deleted, kubelet can't read VolumeAttachment objects. It
should cache all information in a json file.

Create the json file with metadata as the last item, when everything
else is ready, so we don't need to clean up the file in all error cases
in this function.

… rules to it

…worx volume labels

Fixes kubernetes#64894

Signed-off-by: Harsh Desai <harsh@portworx.com>

…ck-of-#65342-upstream-release-1.10

Automatic merge from submit-queue.

Automated cherry pick of kubernetes#65342: update NPD version to v0.5.0 for gci

Cherry pick of kubernetes#65342 on release-1.10.

kubernetes#65342: update NPD version to v0.5.0 for gci

Fix generated docs as well