Merge pull request #948 from justinsb/fix_build

Updates to fix build
2016-11-19 16:10:39 -05:00 · 2016-11-19 16:10:39 -05:00 · 6c66d18a9c
parent afa5a6f432 76dc86ff49
commit 6c66d18a9c
1368 changed files with 181357 additions and 120888 deletions
--- a/_vendor/k8s.io/kubernetes
+++ b/_vendor/k8s.io/kubernetes
@ -1 +1 @@
-Subproject commit 82c2538cf7541383a3d203e1d850331a507bc80c
+Subproject commit 5b9ef417329fea35e35f510ede2042ad6386dd49
--- a/channels/cmd/channels/get_addons.go
+++ b/channels/cmd/channels/get_addons.go
@ -21,7 +21,6 @@ import (
 	"github.com/spf13/cobra"
 	"k8s.io/kops/channels/pkg/channels"
 	"k8s.io/kops/util/pkg/tables"
-	k8sapi "k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/v1"
 	"os"
 )
@ -60,7 +59,7 @@ func (c *GetAddonsCmd) Run(args []string) error {
 		return err
 	}

-	namespaces, err := k8sClient.Namespaces().List(k8sapi.ListOptions{})
+	namespaces, err := k8sClient.Namespaces().List(v1.ListOptions{})
 	if err != nil {
 		return fmt.Errorf("error listing namespaces: %v", err)
 	}
--- a/channels/cmd/channels/root.go
+++ b/channels/cmd/channels/root.go
@ -23,7 +23,7 @@ import (
 	"github.com/golang/glog"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
-	"k8s.io/kubernetes/pkg/client/clientset_generated/release_1_3"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
 	"k8s.io/kubernetes/pkg/client/unversioned/clientcmd"
 )

@ -79,7 +79,7 @@ func (c *RootCmd) AddCommand(cmd *cobra.Command) {
 	c.cobraCommand.AddCommand(cmd)
 }

-func (c *RootCmd) KubernetesClient() (*release_1_3.Clientset, error) {
+func (c *RootCmd) KubernetesClient() (*release_1_5.Clientset, error) {
 	config := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
 		clientcmd.NewDefaultClientConfigLoadingRules(),
 		&clientcmd.ConfigOverrides{})
@ -96,7 +96,7 @@ func (c *RootCmd) KubernetesClient() (*release_1_3.Clientset, error) {
 		}
 	}

-	k8sClient, err := release_1_3.NewForConfig(clientConfig)
+	k8sClient, err := release_1_5.NewForConfig(clientConfig)
 	if err != nil {
 		return nil, fmt.Errorf("cannot build kube client: %v", err)
 	}
--- a/channels/pkg/channels/addon.go
+++ b/channels/pkg/channels/addon.go
@ -20,7 +20,7 @@ import (
 	"fmt"
 	"github.com/golang/glog"
 	"k8s.io/kops/channels/pkg/api"
-	"k8s.io/kubernetes/pkg/client/clientset_generated/release_1_3"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
 	"k8s.io/kubernetes/pkg/util/validation/field"
 	"net/url"
 )
@ -57,7 +57,7 @@ func (a *Addon) buildChannel() *Channel {
 	}
 	return channel
 }
-func (a *Addon) GetRequiredUpdates(k8sClient *release_1_3.Clientset) (*AddonUpdate, error) {
+func (a *Addon) GetRequiredUpdates(k8sClient *release_1_5.Clientset) (*AddonUpdate, error) {
 	newVersion := a.ChannelVersion()

 	channel := a.buildChannel()
@ -78,7 +78,7 @@ func (a *Addon) GetRequiredUpdates(k8sClient *release_1_3.Clientset) (*AddonUpda
 	}, nil
 }

-func (a *Addon) EnsureUpdated(k8sClient *release_1_3.Clientset) (*AddonUpdate, error) {
+func (a *Addon) EnsureUpdated(k8sClient *release_1_5.Clientset) (*AddonUpdate, error) {
 	required, err := a.GetRequiredUpdates(k8sClient)
 	if err != nil {
 		return nil, err
--- a/channels/pkg/channels/channel_version.go
+++ b/channels/pkg/channels/channel_version.go
@ -21,10 +21,9 @@ import (
 	"fmt"
 	"github.com/blang/semver"
 	"github.com/golang/glog"
-	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/v1"
-	"k8s.io/kubernetes/pkg/client/clientset_generated/release_1_3"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
 	"strings"
 )

@ -47,7 +46,7 @@ func stringValue(s *string) string {
 	return *s
 }

-func (c *ChannelVersion) String() {
+func (c *ChannelVersion) String() string {
 	return "Version=" + stringValue(c.Version) + " Channel=" + stringValue(c.Channel)
 }

@ -116,7 +115,7 @@ func (c *ChannelVersion) Replaces(existing *ChannelVersion) bool {
 	return true
 }

-func (c *Channel) GetInstalledVersion(k8sClient *release_1_3.Clientset) (*ChannelVersion, error) {
+func (c *Channel) GetInstalledVersion(k8sClient *release_1_5.Clientset) (*ChannelVersion, error) {
 	ns, err := k8sClient.Namespaces().Get(c.Namespace)
 	if err != nil {
 		return nil, fmt.Errorf("error querying namespace %q: %v", c.Namespace, err)
@ -137,7 +136,7 @@ type annotationPatchMetadata struct {
 	Annotations map[string]string `json:"annotations,omitempty"`
 }

-func (c *Channel) SetInstalledVersion(k8sClient *release_1_3.Clientset, version *ChannelVersion) error {
+func (c *Channel) SetInstalledVersion(k8sClient *release_1_5.Clientset, version *ChannelVersion) error {
 	// Primarily to check it exists
 	_, err := k8sClient.Namespaces().Get(c.Namespace)
 	if err != nil {
--- a/cmd/kops/create_cluster.go
+++ b/cmd/kops/create_cluster.go
@ -538,7 +538,6 @@ func parseZoneList(s string) []string {

 func supportsPrivateTopology(n *api.NetworkingSpec) bool {

-
 	if n.CNI != nil || n.Kopeio != nil || n.Weave != nil {
 		return true
 	}
--- a/dns-controller/cmd/dns-controller/main.go
+++ b/dns-controller/cmd/dns-controller/main.go
@ -23,8 +23,8 @@ import (
 	"k8s.io/kops/dns-controller/pkg/dns"
 	"k8s.io/kops/dns-controller/pkg/watchers"
 	"k8s.io/kubernetes/federation/pkg/dnsprovider"
-	client "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_3/typed/core/v1"
-	client_extensions "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_3/typed/extensions/v1beta1"
+	client "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5/typed/core/v1"
+	client_extensions "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5/typed/extensions/v1beta1"
 	kubectl_util "k8s.io/kubernetes/pkg/kubectl/cmd/util"
 	"os"

--- a/dns-controller/pkg/dns/dnscontroller.go
+++ b/dns-controller/pkg/dns/dnscontroller.go
@ -23,7 +23,6 @@ import (
 	"github.com/golang/glog"

 	"k8s.io/kops/dns-controller/pkg/util"
-	"k8s.io/kops/upup/pkg/fi/utils"
 	"k8s.io/kubernetes/federation/pkg/dnsprovider"
 	"k8s.io/kubernetes/federation/pkg/dnsprovider/rrstype"
 	"sort"
@ -247,7 +246,7 @@ func (c *DNSController) runOnce() error {
 		}
 		oldValues := oldValueMap[k]

-		if utils.StringSlicesEqual(newValues, oldValues) {
+		if util.StringSlicesEqual(newValues, oldValues) {
 			glog.V(4).Infof("no change to records for %s", k)
 			continue
 		}
--- a/dns-controller/pkg/util/equality.go
+++ b/dns-controller/pkg/util/equality.go
@ -0,0 +1,29 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+func StringSlicesEqual(l, r []string) bool {
+	if len(l) != len(r) {
+		return false
+	}
+	for i, v := range l {
+		if r[i] != v {
+			return false
+		}
+	}
+	return true
+}
--- a/dns-controller/pkg/watchers/ingresscontroller.go
+++ b/dns-controller/pkg/watchers/ingresscontroller.go
@ -22,26 +22,23 @@ import (

 	"github.com/golang/glog"

-	"k8s.io/kubernetes/pkg/api"
-	"k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
-	client_extensions "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_3/typed/extensions/v1beta1"
-	"k8s.io/kubernetes/pkg/fields"
-	"k8s.io/kubernetes/pkg/labels"
-
 	"k8s.io/kops/dns-controller/pkg/dns"
 	"k8s.io/kops/dns-controller/pkg/util"
+	"k8s.io/kubernetes/pkg/api/v1"
+	"k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
+	client_extensions "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5/typed/extensions/v1beta1"
 	"k8s.io/kubernetes/pkg/watch"
 )

 // IngressController watches for Ingress objects with dns labels
 type IngressController struct {
 	util.Stoppable
-	kubeClient *client_extensions.ExtensionsClient
+	kubeClient client_extensions.ExtensionsV1beta1Interface
 	scope      dns.Scope
 }

 // newIngressController creates a ingressController
-func NewIngressController(kubeClient *client_extensions.ExtensionsClient, dns dns.Context) (*IngressController, error) {
+func NewIngressController(kubeClient client_extensions.ExtensionsV1beta1Interface, dns dns.Context) (*IngressController, error) {
 	scope, err := dns.CreateScope("ingress")
 	if err != nil {
 		return nil, fmt.Errorf("error building dns scope: %v", err)
@ -67,11 +64,11 @@ func (c *IngressController) Run() {

 func (c *IngressController) runWatcher(stopCh <-chan struct{}) {
 	runOnce := func() (bool, error) {
-		var listOpts api.ListOptions
+		var listOpts v1.ListOptions
 		glog.Warningf("querying without label filter")
-		listOpts.LabelSelector = labels.Everything()
+		//listOpts.LabelSelector = labels.Everything()
 		glog.Warningf("querying without field filter")
-		listOpts.FieldSelector = fields.Everything()
+		//listOpts.FieldSelector = fields.Everything()
 		ingressList, err := c.kubeClient.Ingresses("").List(listOpts)
 		if err != nil {
 			return false, fmt.Errorf("error listing ingresss: %v", err)
@ -84,9 +81,9 @@ func (c *IngressController) runWatcher(stopCh <-chan struct{}) {
 		c.scope.MarkReady()

 		glog.Warningf("querying without label filter")
-		listOpts.LabelSelector = labels.Everything()
+		//listOpts.LabelSelector = labels.Everything()
 		glog.Warningf("querying without field filter")
-		listOpts.FieldSelector = fields.Everything()
+		//listOpts.FieldSelector = fields.Everything()
 		listOpts.Watch = true
 		listOpts.ResourceVersion = ingressList.ResourceVersion
 		watcher, err := c.kubeClient.Ingresses("").Watch(listOpts)
--- a/dns-controller/pkg/watchers/nodecontroller.go
+++ b/dns-controller/pkg/watchers/nodecontroller.go
@ -24,23 +24,20 @@ import (

 	"k8s.io/kops/dns-controller/pkg/dns"
 	"k8s.io/kops/dns-controller/pkg/util"
-	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/v1"
-	client "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_3/typed/core/v1"
-	"k8s.io/kubernetes/pkg/fields"
-	"k8s.io/kubernetes/pkg/labels"
+	client "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5/typed/core/v1"
 	"k8s.io/kubernetes/pkg/watch"
 )

 // NodeController watches for nodes
 type NodeController struct {
 	util.Stoppable
-	kubeClient *client.CoreClient
+	kubeClient client.CoreV1Interface
 	scope      dns.Scope
 }

 // newNodeController creates a nodeController
-func NewNodeController(kubeClient *client.CoreClient, dns dns.Context) (*NodeController, error) {
+func NewNodeController(kubeClient client.CoreV1Interface, dns dns.Context) (*NodeController, error) {
 	scope, err := dns.CreateScope("node")
 	if err != nil {
 		return nil, fmt.Errorf("error building dns scope: %v", err)
@ -66,12 +63,12 @@ func (c *NodeController) Run() {

 func (c *NodeController) runWatcher(stopCh <-chan struct{}) {
 	runOnce := func() (bool, error) {
-		var listOpts api.ListOptions
+		var listOpts v1.ListOptions

 		// Note we need to watch all the nodes, to set up alias targets
-		listOpts.LabelSelector = labels.Everything()
+		//listOpts.LabelSelector = labels.Everything()
 		glog.Warningf("querying without field filter")
-		listOpts.FieldSelector = fields.Everything()
+		//listOpts.FieldSelector = fields.Everything()

 		nodeList, err := c.kubeClient.Nodes().List(listOpts)
 		if err != nil {
@ -85,9 +82,9 @@ func (c *NodeController) runWatcher(stopCh <-chan struct{}) {
 		c.scope.MarkReady()

 		// Note we need to watch all the nodes, to set up alias targets
-		listOpts.LabelSelector = labels.Everything()
+		//listOpts.LabelSelector = labels.Everything()
 		glog.Warningf("querying without field filter")
-		listOpts.FieldSelector = fields.Everything()
+		//listOpts.FieldSelector = fields.Everything()

 		listOpts.Watch = true
 		listOpts.ResourceVersion = nodeList.ResourceVersion
--- a/dns-controller/pkg/watchers/podcontroller.go
+++ b/dns-controller/pkg/watchers/podcontroller.go
@ -24,11 +24,8 @@ import (

 	"k8s.io/kops/dns-controller/pkg/dns"
 	"k8s.io/kops/dns-controller/pkg/util"
-	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/v1"
-	client "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_3/typed/core/v1"
-	"k8s.io/kubernetes/pkg/fields"
-	"k8s.io/kubernetes/pkg/labels"
+	client "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5/typed/core/v1"
 	"k8s.io/kubernetes/pkg/watch"
 	"strings"
 )
@ -36,12 +33,12 @@ import (
 // PodController watches for Pods with dns annotations
 type PodController struct {
 	util.Stoppable
-	kubeClient *client.CoreClient
+	kubeClient client.CoreV1Interface
 	scope      dns.Scope
 }

 // newPodController creates a podController
-func NewPodController(kubeClient *client.CoreClient, dns dns.Context) (*PodController, error) {
+func NewPodController(kubeClient client.CoreV1Interface, dns dns.Context) (*PodController, error) {
 	scope, err := dns.CreateScope("pod")
 	if err != nil {
 		return nil, fmt.Errorf("error building dns scope: %v", err)
@ -67,11 +64,11 @@ func (c *PodController) Run() {

 func (c *PodController) runWatcher(stopCh <-chan struct{}) {
 	runOnce := func() (bool, error) {
-		var listOpts api.ListOptions
+		var listOpts v1.ListOptions
 		glog.Warningf("querying without label filter")
-		listOpts.LabelSelector = labels.Everything()
+		//listOpts.LabelSelector = labels.Everything()
 		glog.Warningf("querying without field filter")
-		listOpts.FieldSelector = fields.Everything()
+		//listOpts.FieldSelector = fields.Everything()
 		podList, err := c.kubeClient.Pods("").List(listOpts)
 		if err != nil {
 			return false, fmt.Errorf("error listing pods: %v", err)
@ -84,9 +81,9 @@ func (c *PodController) runWatcher(stopCh <-chan struct{}) {
 		c.scope.MarkReady()

 		glog.Warningf("querying without label filter")
-		listOpts.LabelSelector = labels.Everything()
+		//listOpts.LabelSelector = labels.Everything()
 		glog.Warningf("querying without field filter")
-		listOpts.FieldSelector = fields.Everything()
+		//listOpts.FieldSelector = fields.Everything()
 		listOpts.Watch = true
 		listOpts.ResourceVersion = podList.ResourceVersion
 		watcher, err := c.kubeClient.Pods("").Watch(listOpts)
--- a/dns-controller/pkg/watchers/servicecontroller.go
+++ b/dns-controller/pkg/watchers/servicecontroller.go
@ -24,11 +24,8 @@ import (

 	"k8s.io/kops/dns-controller/pkg/dns"
 	"k8s.io/kops/dns-controller/pkg/util"
-	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/v1"
-	client "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_3/typed/core/v1"
-	"k8s.io/kubernetes/pkg/fields"
-	"k8s.io/kubernetes/pkg/labels"
+	client "k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5/typed/core/v1"
 	"k8s.io/kubernetes/pkg/watch"
 	"strings"
 )
@ -36,12 +33,12 @@ import (
 // ServiceController watches for services with dns annotations
 type ServiceController struct {
 	util.Stoppable
-	kubeClient *client.CoreClient
+	kubeClient client.CoreV1Interface
 	scope      dns.Scope
 }

 // newServiceController creates a serviceController
-func NewServiceController(kubeClient *client.CoreClient, dns dns.Context) (*ServiceController, error) {
+func NewServiceController(kubeClient client.CoreV1Interface, dns dns.Context) (*ServiceController, error) {
 	scope, err := dns.CreateScope("service")
 	if err != nil {
 		return nil, fmt.Errorf("error building dns scope: %v", err)
@ -67,11 +64,11 @@ func (c *ServiceController) Run() {

 func (c *ServiceController) runWatcher(stopCh <-chan struct{}) {
 	runOnce := func() (bool, error) {
-		var listOpts api.ListOptions
+		var listOpts v1.ListOptions
 		glog.Warningf("querying without label filter")
-		listOpts.LabelSelector = labels.Everything()
+		//listOpts.LabelSelector = labels.Everything()
 		glog.Warningf("querying without field filter")
-		listOpts.FieldSelector = fields.Everything()
+		//listOpts.FieldSelector = fields.Everything()
 		serviceList, err := c.kubeClient.Services("").List(listOpts)
 		if err != nil {
 			return false, fmt.Errorf("error listing services: %v", err)
@ -84,9 +81,9 @@ func (c *ServiceController) runWatcher(stopCh <-chan struct{}) {
 		c.scope.MarkReady()

 		glog.Warningf("querying without label filter")
-		listOpts.LabelSelector = labels.Everything()
+		//listOpts.LabelSelector = labels.Everything()
 		glog.Warningf("querying without field filter")
-		listOpts.FieldSelector = fields.Everything()
+		//listOpts.FieldSelector = fields.Everything()
 		listOpts.Watch = true
 		listOpts.ResourceVersion = serviceList.ResourceVersion
 		watcher, err := c.kubeClient.Services("").Watch(listOpts)
--- a/images/protokube-builder/onbuild.sh
+++ b/images/protokube-builder/onbuild.sh
@ -1,3 +1,5 @@
+#!/bin/bash -ex
+
 # Copyright 2016 The Kubernetes Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@ -12,8 +14,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-#!/bin/bash -ex
-
 mkdir -p /go
 export GOPATH=/go

--- a/protokube/pkg/protokube/kube_context.go
+++ b/protokube/pkg/protokube/kube_context.go
@ -19,21 +19,21 @@ package protokube
 import (
 	"fmt"
 	"github.com/golang/glog"
-	"k8s.io/kubernetes/pkg/client/clientset_generated/release_1_3"
+	"k8s.io/kubernetes/pkg/client/clientset_generated/release_1_5"
 	"k8s.io/kubernetes/pkg/client/unversioned/clientcmd"
 	"sync"
 )

 type KubernetesContext struct {
 	mutex  sync.Mutex
-	client *release_1_3.Clientset
+	client *release_1_5.Clientset
 }

 func NewKubernetesContext() *KubernetesContext {
 	return &KubernetesContext{}
 }

-func (c *KubernetesContext) KubernetesClient() (*release_1_3.Clientset, error) {
+func (c *KubernetesContext) KubernetesClient() (*release_1_5.Clientset, error) {
 	c.mutex.Lock()
 	defer c.mutex.Unlock()

@ -54,7 +54,7 @@ func (c *KubernetesContext) KubernetesClient() (*release_1_3.Clientset, error) {
 			}
 		}

-		k8sClient, err := release_1_3.NewForConfig(clientConfig)
+		k8sClient, err := release_1_5.NewForConfig(clientConfig)
 		if err != nil {
 			return nil, fmt.Errorf("cannot build kube client: %v", err)
 		}
--- a/protokube/pkg/protokube/tainter.go
+++ b/protokube/pkg/protokube/tainter.go
@ -21,6 +21,7 @@ import (
 	"fmt"
 	"github.com/golang/glog"
 	"k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api/v1"
 	"k8s.io/kubernetes/pkg/labels"
 )

@ -46,8 +47,8 @@ func ApplyMasterTaints(kubeContext *KubernetesContext) error {
 		return err
 	}

-	options := api.ListOptions{
-		LabelSelector: labels.SelectorFromSet(labels.Set{"kubernetes.io/role": "master"}),
+	options := v1.ListOptions{
+		LabelSelector: labels.SelectorFromSet(labels.Set{"kubernetes.io/role": "master"}).String(),
 	}
 	glog.V(2).Infof("Querying k8s for nodes with selector %q", options.LabelSelector)
 	nodes, err := client.Core().Nodes().List(options)
--- a/protokube/pkg/protokube/volume_mounter.go
+++ b/protokube/pkg/protokube/volume_mounter.go
@ -105,7 +105,7 @@ func (k *VolumeMountController) safeFormatAndMount(device string, mountpoint str

 	// If we are containerized, we still first SafeFormatAndMount in our namespace
 	// This is because SafeFormatAndMount doesn't seem to work in a container
-	safeFormatAndMount := &mount.SafeFormatAndMount{Interface: mount.New(), Runner: exec.New()}
+	safeFormatAndMount := &mount.SafeFormatAndMount{Interface: mount.New(""), Runner: exec.New()}

 	// Check if it is already mounted
 	mounts, err := safeFormatAndMount.List()
--- a/upup/pkg/fi/cloudup/tagbuilder.go
+++ b/upup/pkg/fi/cloudup/tagbuilder.go
@ -52,7 +52,7 @@ func buildCloudupTags(cluster *api.Cluster) (map[string]struct{}, error) {
 		tags["_networking_external"] = struct{}{}
 	} else if networking.CNI != nil || networking.Weave != nil {
 		tags["_networking_cni"] = struct{}{}
-	// TODO combine with the External
+		// TODO combine with the External
 	} else if networking.Kopeio != nil {
 		// Kopeio is based on kubenet / external
 		tags["_networking_kubenet"] = struct{}{}
--- a/upup/pkg/fi/cloudup/tagbuilder_test.go
+++ b/upup/pkg/fi/cloudup/tagbuilder_test.go
@ -65,7 +65,7 @@ func buildCluster(clusterArgs interface{}) *api.Cluster {
 func TestBuildTags_CloudProvider_AWS_Weave(t *testing.T) {

 	c := buildCluster(nil)
-	networking := &api.NetworkingSpec{ Weave: &api.WeaveNetworkingSpec{} }
+	networking := &api.NetworkingSpec{Weave: &api.WeaveNetworkingSpec{}}

 	c.Spec.Networking = networking

--- a/upup/pkg/fi/nodeup/nodetasks/mount_disk.go
+++ b/upup/pkg/fi/nodeup/nodetasks/mount_disk.go
@ -58,7 +58,7 @@ func NewMountDiskTask(name string, contents string, meta string) (fi.Task, error
 }

 func (e *MountDiskTask) Find(c *fi.Context) (*MountDiskTask, error) {
-	mounter := mount.New()
+	mounter := mount.New("")

 	mps, err := mounter.List()
 	if err != nil {
@ -121,7 +121,7 @@ func (_ *MountDiskTask) RenderLocal(t *local.LocalTarget, a, e, changes *MountDi
 	if changes.Mountpoint != "" {
 		glog.Infof("Mounting device %q on %q", e.Device, e.Mountpoint)

-		mounter := &mount.SafeFormatAndMount{Interface: mount.New(), Runner: exec.New()}
+		mounter := &mount.SafeFormatAndMount{Interface: mount.New(""), Runner: exec.New()}

 		fstype := ""
 		options := []string{}
--- a/vendor/k8s.io/kubernetes/.generated_docs
+++ b/vendor/k8s.io/kubernetes/.generated_docs
@ -15,6 +15,9 @@ docs/man/man1/kubectl-api-versions.1
 docs/man/man1/kubectl-apply.1
 docs/man/man1/kubectl-attach.1
 docs/man/man1/kubectl-autoscale.1
+docs/man/man1/kubectl-certificate-approve.1
+docs/man/man1/kubectl-certificate-deny.1
+docs/man/man1/kubectl-certificate.1
 docs/man/man1/kubectl-cluster-info-dump.1
 docs/man/man1/kubectl-cluster-info.1
 docs/man/man1/kubectl-completion.1
@ -90,6 +93,9 @@ docs/user-guide/kubectl/kubectl_api-versions.md
 docs/user-guide/kubectl/kubectl_apply.md
 docs/user-guide/kubectl/kubectl_attach.md
 docs/user-guide/kubectl/kubectl_autoscale.md
+docs/user-guide/kubectl/kubectl_certificate.md
+docs/user-guide/kubectl/kubectl_certificate_approve.md
+docs/user-guide/kubectl/kubectl_certificate_deny.md
 docs/user-guide/kubectl/kubectl_cluster-info.md
 docs/user-guide/kubectl/kubectl_cluster-info_dump.md
 docs/user-guide/kubectl/kubectl_completion.md
@ -162,6 +168,7 @@ docs/yaml/kubectl/kubectl_api-versions.yaml
 docs/yaml/kubectl/kubectl_apply.yaml
 docs/yaml/kubectl/kubectl_attach.yaml
 docs/yaml/kubectl/kubectl_autoscale.yaml
+docs/yaml/kubectl/kubectl_certificate.yaml
 docs/yaml/kubectl/kubectl_cluster-info.yaml
 docs/yaml/kubectl/kubectl_completion.yaml
 docs/yaml/kubectl/kubectl_config.yaml
--- a/vendor/k8s.io/kubernetes/.generated_files
+++ b/vendor/k8s.io/kubernetes/.generated_files
@ -0,0 +1,30 @@
+# Files that should be ignored by tools which do not want to consider generated
+# code.
+#
+# https://github.com/kubernetes/contrib/blob/master/mungegithub/mungers/size.go
+#
+# This file is a series of lines, each of the form:
+#     <type> <name>
+#
+# Type can be:
+#    path - an exact path to a single file
+#    file-name - an exact leaf filename, regardless of path
+#    path-prefix - a prefix match on the file path
+#    file-prefix - a prefix match of the leaf filename (no path)
+#    paths-from-repo - read a file from the repo and load file paths
+#
+
+file-prefix	zz_generated.
+
+file-name	BUILD
+file-name	types.generated.go
+file-name	generated.pb.go
+file-name	generated.proto
+file-name	types_swagger_doc_generated.go
+
+path-prefix	Godeps/
+path-prefix	vendor/
+path-prefix	api/swagger-spec/
+path-prefix	pkg/generated/
+
+paths-from-repo	.generated_docs
--- a/vendor/k8s.io/kubernetes/.github/PULL_REQUEST_TEMPLATE.md
+++ b/vendor/k8s.io/kubernetes/.github/PULL_REQUEST_TEMPLATE.md
@ -6,7 +6,7 @@

 **What this PR does / why we need it**:

-**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
+**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

 **Special notes for your reviewer**:

--- a/vendor/k8s.io/kubernetes/CHANGELOG.md
+++ b/vendor/k8s.io/kubernetes/CHANGELOG.md
@ -1,69 +1,75 @@
 <!-- BEGIN MUNGE: GENERATED_TOC -->

- [v1.3.10](#v1310)
-  - [Downloads for v1.3.10](#downloads-for-v1310)
+- [v1.4.6](#v146)
+  - [Downloads for v1.4.6](#downloads-for-v146)
    - [Client Binaries](#client-binaries)
    - [Server Binaries](#server-binaries)
-  - [Changelog since v1.3.9](#changelog-since-v139)
+  - [Changelog since v1.4.5](#changelog-since-v145)
    - [Other notable changes](#other-notable-changes)
- [v1.4.5](#v145)
-  - [Downloads for v1.4.5](#downloads-for-v145)
+- [v1.3.10](#v1310)
+  - [Downloads for v1.3.10](#downloads-for-v1310)
    - [Client Binaries](#client-binaries-1)
    - [Server Binaries](#server-binaries-1)
-  - [Changelog since v1.4.4](#changelog-since-v144)
+  - [Changelog since v1.3.9](#changelog-since-v139)
    - [Other notable changes](#other-notable-changes-1)
- [v1.5.0-alpha.2](#v150-alpha2)
-  - [Downloads for v1.5.0-alpha.2](#downloads-for-v150-alpha2)
+- [v1.4.5](#v145)
+  - [Downloads for v1.4.5](#downloads-for-v145)
    - [Client Binaries](#client-binaries-2)
    - [Server Binaries](#server-binaries-2)
-  - [Changelog since v1.5.0-alpha.1](#changelog-since-v150-alpha1)
-    - [Action Required](#action-required)
+  - [Changelog since v1.4.4](#changelog-since-v144)
    - [Other notable changes](#other-notable-changes-2)
- [v1.2.7](#v127)
-  - [Downloads for v1.2.7](#downloads-for-v127)
+- [v1.5.0-alpha.2](#v150-alpha2)
+  - [Downloads for v1.5.0-alpha.2](#downloads-for-v150-alpha2)
    - [Client Binaries](#client-binaries-3)
    - [Server Binaries](#server-binaries-3)
-  - [Changelog since v1.2.6](#changelog-since-v126)
+  - [Changelog since v1.5.0-alpha.1](#changelog-since-v150-alpha1)
+    - [Action Required](#action-required)
    - [Other notable changes](#other-notable-changes-3)
- [v1.4.4](#v144)
-  - [Downloads for v1.4.4](#downloads-for-v144)
+- [v1.2.7](#v127)
+  - [Downloads for v1.2.7](#downloads-for-v127)
    - [Client Binaries](#client-binaries-4)
    - [Server Binaries](#server-binaries-4)
-  - [Changelog since v1.4.3](#changelog-since-v143)
+  - [Changelog since v1.2.6](#changelog-since-v126)
    - [Other notable changes](#other-notable-changes-4)
+- [v1.4.4](#v144)
+  - [Downloads for v1.4.4](#downloads-for-v144)
+    - [Client Binaries](#client-binaries-5)
+    - [Server Binaries](#server-binaries-5)
+  - [Changelog since v1.4.3](#changelog-since-v143)
+    - [Other notable changes](#other-notable-changes-5)
 - [v1.3.9](#v139)
  - [Downloads](#downloads)
  - [Changelog since v1.3.8](#changelog-since-v138)
-    - [Other notable changes](#other-notable-changes-5)
+    - [Other notable changes](#other-notable-changes-6)
 - [v1.4.3](#v143)
  - [Downloads](#downloads-1)
  - [Changelog since v1.4.2-beta.1](#changelog-since-v142-beta1)
-    - [Other notable changes](#other-notable-changes-6)
+    - [Other notable changes](#other-notable-changes-7)
 - [v1.4.2](#v142)
  - [Downloads](#downloads-2)
  - [Changelog since v1.4.2-beta.1](#changelog-since-v142-beta1-1)
-    - [Other notable changes](#other-notable-changes-7)
+    - [Other notable changes](#other-notable-changes-8)
 - [v1.5.0-alpha.1](#v150-alpha1)
  - [Downloads](#downloads-3)
  - [Changelog since v1.4.0-alpha.3](#changelog-since-v140-alpha3)
    - [Experimental Features](#experimental-features)
    - [Action Required](#action-required-1)
-    - [Other notable changes](#other-notable-changes-8)
+    - [Other notable changes](#other-notable-changes-9)
 - [v1.4.2-beta.1](#v142-beta1)
  - [Downloads](#downloads-4)
  - [Changelog since v1.4.1](#changelog-since-v141)
-    - [Other notable changes](#other-notable-changes-9)
+    - [Other notable changes](#other-notable-changes-10)
 - [v1.4.1](#v141)
  - [Downloads](#downloads-5)
  - [Changelog since v1.4.1-beta.2](#changelog-since-v141-beta2)
 - [v1.4.1-beta.2](#v141-beta2)
  - [Downloads](#downloads-6)
  - [Changelog since v1.4.0](#changelog-since-v140)
-    - [Other notable changes](#other-notable-changes-10)
+    - [Other notable changes](#other-notable-changes-11)
 - [v1.3.8](#v138)
  - [Downloads](#downloads-7)
  - [Changelog since v1.3.7](#changelog-since-v137)
-    - [Other notable changes](#other-notable-changes-11)
+    - [Other notable changes](#other-notable-changes-12)
 - [v1.4.0](#v140)
  - [Downloads](#downloads-8)
  - [Major Themes](#major-themes)
@ -82,26 +88,26 @@
 - [v1.4.0-beta.10](#v140-beta10)
  - [Downloads](#downloads-10)
  - [Changelog since v1.4.0-beta.8](#changelog-since-v140-beta8)
-    - [Other notable changes](#other-notable-changes-12)
+    - [Other notable changes](#other-notable-changes-13)
 - [v1.4.0-beta.8](#v140-beta8)
  - [Downloads](#downloads-11)
  - [Changelog since v1.4.0-beta.7](#changelog-since-v140-beta7)
 - [v1.4.0-beta.7](#v140-beta7)
  - [Downloads](#downloads-12)
  - [Changelog since v1.4.0-beta.6](#changelog-since-v140-beta6)
-    - [Other notable changes](#other-notable-changes-13)
+    - [Other notable changes](#other-notable-changes-14)
 - [v1.4.0-beta.6](#v140-beta6)
  - [Downloads](#downloads-13)
  - [Changelog since v1.4.0-beta.5](#changelog-since-v140-beta5)
-    - [Other notable changes](#other-notable-changes-14)
+    - [Other notable changes](#other-notable-changes-15)
 - [v1.4.0-beta.5](#v140-beta5)
  - [Downloads](#downloads-14)
  - [Changelog since v1.4.0-beta.3](#changelog-since-v140-beta3)
-    - [Other notable changes](#other-notable-changes-15)
+    - [Other notable changes](#other-notable-changes-16)
 - [v1.3.7](#v137)
  - [Downloads](#downloads-15)
  - [Changelog since v1.3.6](#changelog-since-v136)
-    - [Other notable changes](#other-notable-changes-16)
+    - [Other notable changes](#other-notable-changes-17)
 - [v1.4.0-beta.3](#v140-beta3)
  - [Downloads](#downloads-16)
  - [Changelog since v1.4.0-beta.2](#changelog-since-v140-beta2)
@ -112,57 +118,57 @@
 - [v1.4.0-beta.2](#v140-beta2)
  - [Downloads](#downloads-17)
  - [Changelog since v1.4.0-beta.1](#changelog-since-v140-beta1)
-    - [Other notable changes](#other-notable-changes-17)
+    - [Other notable changes](#other-notable-changes-18)
 - [v1.4.0-beta.1](#v140-beta1)
  - [Downloads](#downloads-18)
  - [Changelog since v1.4.0-alpha.3](#changelog-since-v140-alpha3-1)
    - [Action Required](#action-required-2)
-    - [Other notable changes](#other-notable-changes-18)
+    - [Other notable changes](#other-notable-changes-19)
 - [v1.3.6](#v136)
  - [Downloads](#downloads-19)
  - [Changelog since v1.3.5](#changelog-since-v135)
-    - [Other notable changes](#other-notable-changes-19)
+    - [Other notable changes](#other-notable-changes-20)
 - [v1.4.0-alpha.3](#v140-alpha3)
  - [Downloads](#downloads-20)
  - [Changelog since v1.4.0-alpha.2](#changelog-since-v140-alpha2)
    - [Action Required](#action-required-3)
-    - [Other notable changes](#other-notable-changes-20)
+    - [Other notable changes](#other-notable-changes-21)
 - [v1.3.5](#v135)
  - [Downloads](#downloads-21)
  - [Changelog since v1.3.4](#changelog-since-v134)
-    - [Other notable changes](#other-notable-changes-21)
+    - [Other notable changes](#other-notable-changes-22)
 - [v1.3.4](#v134)
  - [Downloads](#downloads-22)
  - [Changelog since v1.3.3](#changelog-since-v133)
-    - [Other notable changes](#other-notable-changes-22)
+    - [Other notable changes](#other-notable-changes-23)
 - [v1.4.0-alpha.2](#v140-alpha2)
  - [Downloads](#downloads-23)
  - [Changelog since v1.4.0-alpha.1](#changelog-since-v140-alpha1)
    - [Action Required](#action-required-4)
-    - [Other notable changes](#other-notable-changes-23)
+    - [Other notable changes](#other-notable-changes-24)
 - [v1.3.3](#v133)
  - [Downloads](#downloads-24)
  - [Changelog since v1.3.2](#changelog-since-v132)
-    - [Other notable changes](#other-notable-changes-24)
+    - [Other notable changes](#other-notable-changes-25)
  - [Known Issues](#known-issues-1)
 - [v1.3.2](#v132)
  - [Downloads](#downloads-25)
  - [Changelog since v1.3.1](#changelog-since-v131)
-    - [Other notable changes](#other-notable-changes-25)
+    - [Other notable changes](#other-notable-changes-26)
 - [v1.3.1](#v131)
  - [Downloads](#downloads-26)
  - [Changelog since v1.3.0](#changelog-since-v130)
-    - [Other notable changes](#other-notable-changes-26)
+    - [Other notable changes](#other-notable-changes-27)
 - [v1.2.6](#v126)
  - [Downloads](#downloads-27)
  - [Changelog since v1.2.5](#changelog-since-v125)
-    - [Other notable changes](#other-notable-changes-27)
+    - [Other notable changes](#other-notable-changes-28)
 - [v1.4.0-alpha.1](#v140-alpha1)
  - [Downloads](#downloads-28)
  - [Changelog since v1.3.0](#changelog-since-v130-1)
    - [Experimental Features](#experimental-features-1)
    - [Action Required](#action-required-5)
-    - [Other notable changes](#other-notable-changes-28)
+    - [Other notable changes](#other-notable-changes-29)
 - [v1.3.0](#v130)
  - [Downloads](#downloads-29)
  - [Highlights](#highlights)
@ -178,62 +184,62 @@
  - [Downloads](#downloads-30)
  - [Changelog since v1.3.0-beta.2](#changelog-since-v130-beta2)
    - [Action Required](#action-required-6)
-    - [Other notable changes](#other-notable-changes-29)
+    - [Other notable changes](#other-notable-changes-30)
 - [v1.2.5](#v125)
  - [Downloads](#downloads-31)
  - [Changes since v1.2.4](#changes-since-v124)
-    - [Other notable changes](#other-notable-changes-30)
+    - [Other notable changes](#other-notable-changes-31)
 - [v1.3.0-beta.2](#v130-beta2)
  - [Downloads](#downloads-32)
  - [Changes since v1.3.0-beta.1](#changes-since-v130-beta1)
    - [Experimental Features](#experimental-features-2)
-    - [Other notable changes](#other-notable-changes-31)
+    - [Other notable changes](#other-notable-changes-32)
 - [v1.3.0-beta.1](#v130-beta1)
  - [Downloads](#downloads-33)
  - [Changes since v1.3.0-alpha.5](#changes-since-v130-alpha5)
    - [Action Required](#action-required-7)
-    - [Other notable changes](#other-notable-changes-32)
+    - [Other notable changes](#other-notable-changes-33)
 - [v1.3.0-alpha.5](#v130-alpha5)
  - [Downloads](#downloads-34)
  - [Changes since v1.3.0-alpha.4](#changes-since-v130-alpha4)
    - [Action Required](#action-required-8)
-    - [Other notable changes](#other-notable-changes-33)
+    - [Other notable changes](#other-notable-changes-34)
 - [v1.3.0-alpha.4](#v130-alpha4)
  - [Downloads](#downloads-35)
  - [Changes since v1.3.0-alpha.3](#changes-since-v130-alpha3)
    - [Action Required](#action-required-9)
-    - [Other notable changes](#other-notable-changes-34)
+    - [Other notable changes](#other-notable-changes-35)
 - [v1.2.4](#v124)
  - [Downloads](#downloads-36)
  - [Changes since v1.2.3](#changes-since-v123)
-    - [Other notable changes](#other-notable-changes-35)
+    - [Other notable changes](#other-notable-changes-36)
 - [v1.3.0-alpha.3](#v130-alpha3)
  - [Downloads](#downloads-37)
  - [Changes since v1.3.0-alpha.2](#changes-since-v130-alpha2)
    - [Action Required](#action-required-10)
-    - [Other notable changes](#other-notable-changes-36)
+    - [Other notable changes](#other-notable-changes-37)
 - [v1.2.3](#v123)
  - [Downloads](#downloads-38)
  - [Changes since v1.2.2](#changes-since-v122)
    - [Action Required](#action-required-11)
-    - [Other notable changes](#other-notable-changes-37)
+    - [Other notable changes](#other-notable-changes-38)
 - [v1.3.0-alpha.2](#v130-alpha2)
  - [Downloads](#downloads-39)
  - [Changes since v1.3.0-alpha.1](#changes-since-v130-alpha1)
-    - [Other notable changes](#other-notable-changes-38)
+    - [Other notable changes](#other-notable-changes-39)
 - [v1.2.2](#v122)
  - [Downloads](#downloads-40)
  - [Changes since v1.2.1](#changes-since-v121)
-    - [Other notable changes](#other-notable-changes-39)
+    - [Other notable changes](#other-notable-changes-40)
 - [v1.2.1](#v121)
  - [Downloads](#downloads-41)
  - [Changes since v1.2.0](#changes-since-v120)
-    - [Other notable changes](#other-notable-changes-40)
+    - [Other notable changes](#other-notable-changes-41)
 - [v1.3.0-alpha.1](#v130-alpha1)
  - [Downloads](#downloads-42)
  - [Changes since v1.2.0](#changes-since-v120-1)
    - [Action Required](#action-required-12)
-    - [Other notable changes](#other-notable-changes-41)
+    - [Other notable changes](#other-notable-changes-42)
 - [v1.2.0](#v120)
  - [Downloads](#downloads-43)
  - [Changes since v1.1.1](#changes-since-v111)
@ -254,6 +260,64 @@
 <!-- NEW RELEASE NOTES ENTRY -->


+# v1.4.6
+
+[Documentation](http://kubernetes.github.io) & [Examples](http://releases.k8s.io/release-1.4/examples)
+
+## Downloads for v1.4.6
+
+
+filename | sha256 hash
+-------- | -----------
+[kubernetes.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes.tar.gz) | `6f8242aa29493e1f824997748419e4a287c28b06ed13f17b1ba94bf07fdfa3be`
+[kubernetes-src.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-src.tar.gz) | `a2a2d885d246300b52adb5d7e1471b382c77d90a816618518c2a6e9941208e40`
+
+### Client Binaries
+
+filename | sha256 hash
+-------- | -----------
+[kubernetes-client-darwin-386.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-client-darwin-386.tar.gz) | `4db6349c976f893d0000dcb5b2ab09327824d0c38b3beab961711a0951cdfc82`
+[kubernetes-client-darwin-amd64.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-client-darwin-amd64.tar.gz) | `2d31dea858569f518410effb20d3c3b9a6798d706dacbafd85f1f67f9ccbe288`
+[kubernetes-client-linux-386.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-client-linux-386.tar.gz) | `7980cf6132a7a6bf3816b8fd60d7bc1c9cb447d45196c31312b9d73567010909`
+[kubernetes-client-linux-amd64.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-client-linux-amd64.tar.gz) | `95b3cbd339f7d104d5b69b08d53060bfc78bd4ee7a94ede7ba4c0a76b615f8b1`
+[kubernetes-client-linux-arm64.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-client-linux-arm64.tar.gz) | `0f03cff262b0f4cc218b0f79294b4cbd8f92146c31137c75a27012d956864c79`
+[kubernetes-client-linux-arm.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-client-linux-arm.tar.gz) | `f8c76fe8c41a5084cc1a1ab3e08d7e2d815f7baedfadac0dc6f9157ed2c607c9`
+[kubernetes-client-windows-386.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-client-windows-386.tar.gz) | `c29b3c8c8a72246852db048e922ad2221f35e1c309571f73fd9f3d9b01be5f79`
+[kubernetes-client-windows-amd64.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-client-windows-amd64.tar.gz) | `95bf20bdbe354476bbd3647adf72985698ded53a59819baa8268b5811e19f952`
+
+### Server Binaries
+
+filename | sha256 hash
+-------- | -----------
+[kubernetes-server-linux-amd64.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-server-linux-amd64.tar.gz) | `f0a60c45f3360696431288826e56df3b8c18c1dc6fc3f0ea83409f970395e38f`
+[kubernetes-server-linux-arm64.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-server-linux-arm64.tar.gz) | `8c667d4792fcfee821a2041e5d0356e1abc2b3fa6fe7b69c5479e48c858ba29c`
+[kubernetes-server-linux-arm.tar.gz](https://storage.googleapis.com/kubernetes-release/release/v1.4.6/kubernetes-server-linux-arm.tar.gz) | `c57246d484b5f98d6aa16591f2b4c4c1a01ebbc7be05bce8690a4f3b88582844`
+
+## Changelog since v1.4.5
+
+### Other notable changes
+
+* Fix issue in reconstruct volume data when kubelet restarts ([#36616](https://github.com/kubernetes/kubernetes/pull/36616), [@jingxu97](https://github.com/jingxu97))
+* Add sync state loop in master's volume reconciler ([#34859](https://github.com/kubernetes/kubernetes/pull/34859), [@jingxu97](https://github.com/jingxu97))
+* AWS: strong-typing for k8s vs aws volume ids ([#35883](https://github.com/kubernetes/kubernetes/pull/35883), [@justinsb](https://github.com/justinsb))
+* Bump GCI version to gci-beta-55-8872-47-0 ([#36679](https://github.com/kubernetes/kubernetes/pull/36679), [@mtaufen](https://github.com/mtaufen))
+* Fix fetching pids running in a cgroup, which caused problems with OOM score adjustments & setting the /system cgroup ("misc" in the summary API). ([#36614](https://github.com/kubernetes/kubernetes/pull/36614), [@timstclair](https://github.com/timstclair))
+* DELETE requests can now pass in their DeleteOptions as a query parameter or a body parameter, rather than just as a body parameter. ([#35806](https://github.com/kubernetes/kubernetes/pull/35806), [@bdbauer](https://github.com/bdbauer))
+* rkt: Convert image name to be a valid acidentifier ([#34375](https://github.com/kubernetes/kubernetes/pull/34375), [@euank](https://github.com/euank))
+* Remove stale volumes if endpoint/svc creation fails. ([#35285](https://github.com/kubernetes/kubernetes/pull/35285), [@humblec](https://github.com/humblec))
+* Remove Job also from .status.active for Replace strategy ([#35420](https://github.com/kubernetes/kubernetes/pull/35420), [@soltysh](https://github.com/soltysh))
+* Update PodAntiAffinity to ignore calls to subresources ([#35608](https://github.com/kubernetes/kubernetes/pull/35608), [@soltysh](https://github.com/soltysh))
+* Adds TCPCloseWaitTimeout option to kube-proxy for sysctl nf_conntrack_tcp_timeout_time_wait ([#35919](https://github.com/kubernetes/kubernetes/pull/35919), [@bowei](https://github.com/bowei))
+* Fix how we iterate over active jobs when removing them for Replace policy ([#36161](https://github.com/kubernetes/kubernetes/pull/36161), [@soltysh](https://github.com/soltysh))
+* Bump GCI version to latest m55 version in GCE for K8s 1.4 ([#36302](https://github.com/kubernetes/kubernetes/pull/36302), [@mtaufen](https://github.com/mtaufen))
+* Add a check for file size if the reading content returns empty ([#33976](https://github.com/kubernetes/kubernetes/pull/33976), [@jingxu97](https://github.com/jingxu97))
+* Add a retry when reading a file content from a container ([#35560](https://github.com/kubernetes/kubernetes/pull/35560), [@jingxu97](https://github.com/jingxu97))
+* Skip CLOSE_WAIT e2e test if server is 1.4.5 ([#36404](https://github.com/kubernetes/kubernetes/pull/36404), [@bowei](https://github.com/bowei))
+* Adds etcd3 changes ([#36232](https://github.com/kubernetes/kubernetes/pull/36232), [@wojtek-t](https://github.com/wojtek-t))
+* Adds TCPCloseWaitTimeout option to kube-proxy for sysctl nf_conntrack_tcp_timeout_time_wait ([#36099](https://github.com/kubernetes/kubernetes/pull/36099), [@bowei](https://github.com/bowei))
+
+
+
 # v1.3.10

 [Documentation](http://kubernetes.github.io) & [Examples](http://releases.k8s.io/release-1.3/examples)
--- a/vendor/k8s.io/kubernetes/Godeps/Godeps.json
+++ b/vendor/k8s.io/kubernetes/Godeps/Godeps.json
@ -30,22 +30,22 @@
 		},
 		{
 			"ImportPath": "github.com/Azure/azure-sdk-for-go/arm/compute",
-			"Comment": "v3.2.0-beta",
+			"Comment": "v3.1.0-beta-24-g8316b90",
 			"Rev": "8316b9060f9c2443ba0864663245695d570a7fa2"
 		},
 		{
 			"ImportPath": "github.com/Azure/azure-sdk-for-go/arm/network",
-			"Comment": "v3.2.0-beta",
+			"Comment": "v3.1.0-beta-24-g8316b90",
 			"Rev": "8316b9060f9c2443ba0864663245695d570a7fa2"
 		},
 		{
 			"ImportPath": "github.com/Azure/azure-sdk-for-go/arm/storage",
-			"Comment": "v3.2.0-beta",
+			"Comment": "v3.1.0-beta-24-g8316b90",
 			"Rev": "8316b9060f9c2443ba0864663245695d570a7fa2"
 		},
 		{
 			"ImportPath": "github.com/Azure/azure-sdk-for-go/storage",
-			"Comment": "v3.2.0-beta",
+			"Comment": "v3.1.0-beta-24-g8316b90",
 			"Rev": "8316b9060f9c2443ba0864663245695d570a7fa2"
 		},
 		{
@ -368,263 +368,263 @@
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/alarm",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/auth",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/auth/authpb",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/client",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/clientv3",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/compactor",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/discovery",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/error",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/etcdserver",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/etcdserver/api",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/etcdserver/api/v2http",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/etcdserver/api/v2http/httptypes",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/etcdserver/api/v3rpc",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/etcdserver/api/v3rpc/rpctypes",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/etcdserver/auth",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/etcdserver/etcdserverpb",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/etcdserver/membership",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/etcdserver/stats",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/integration",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/lease",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/lease/leasehttp",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/lease/leasepb",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/mvcc",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/mvcc/backend",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/mvcc/mvccpb",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/adt",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/contention",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/crc",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/fileutil",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/httputil",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/idutil",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/ioutil",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/logutil",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/netutil",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/pathutil",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/pbutil",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/runtime",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/schedule",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/testutil",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/tlsutil",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/transport",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/types",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/pkg/wait",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/raft",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/raft/raftpb",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/rafthttp",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/snap",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/snap/snappb",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/store",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/version",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/wal",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/etcd/wal/walpb",
-			"Comment": "v3.0.13",
-			"Rev": "c99d0d4b255f0dfc117b59555c89933192237c27"
+			"Comment": "v3.0.14",
+			"Rev": "8a37349097a592db79ba3087f3cae9cd4b0af21c"
 		},
 		{
 			"ImportPath": "github.com/coreos/go-oidc/http",
@ -1424,14 +1424,17 @@
 		},
 		{
 			"ImportPath": "github.com/heketi/heketi/client/api/go-client",
+			"Comment": "v3.0.0-7-g28b5cc4",
 			"Rev": "28b5cc4cc6d2b9bdfa91ed1b93efaab4931aa697"
 		},
 		{
 			"ImportPath": "github.com/heketi/heketi/pkg/glusterfs/api",
+			"Comment": "v3.0.0-7-g28b5cc4",
 			"Rev": "28b5cc4cc6d2b9bdfa91ed1b93efaab4931aa697"
 		},
 		{
 			"ImportPath": "github.com/heketi/heketi/pkg/utils",
+			"Comment": "v3.0.0-7-g28b5cc4",
 			"Rev": "28b5cc4cc6d2b9bdfa91ed1b93efaab4931aa697"
 		},
 		{
@ -1481,10 +1484,6 @@
 			"Comment": "v3.0.7-72-ga0ff256",
 			"Rev": "a0ff2567cfb70903282db057e799fd826784d41d"
 		},
-		{
-			"ImportPath": "github.com/juju/ratelimit",
-			"Rev": "77ed1c8a01217656d2080ad51981f6e99adaa177"
-		},
 		{
 			"ImportPath": "github.com/kardianos/osext",
 			"Rev": "8fef92e41e22a70e700a96b29f066cda30ea24ef"
@ -2289,6 +2288,16 @@
 			"Comment": "v0.8.0-9-gb5ee639",
 			"Rev": "b5ee639d7aa4b8dbb48ab4f75dddc19f71b5c514"
 		},
+		{
+			"ImportPath": "github.com/vmware/photon-controller-go-sdk/photon",
+			"Comment": "PROMOTED-336",
+			"Rev": "dd6be2029ef341cae37b2557ddd302f68176f832"
+		},
+		{
+			"ImportPath": "github.com/vmware/photon-controller-go-sdk/photon/lightwave",
+			"Comment": "PROMOTED-336",
+			"Rev": "dd6be2029ef341cae37b2557ddd302f68176f832"
+		},
 		{
 			"ImportPath": "github.com/xanzy/go-cloudstack/cloudstack",
 			"Comment": "v2.1.1-1-g1e2cbf6",
--- a/vendor/k8s.io/kubernetes/Godeps/LICENSES
+++ b/vendor/k8s.io/kubernetes/Godeps/LICENSES
@ -50866,205 +50866,6 @@ http://creativecommons.org/publicdomain/zero/1.0
 ================================================================================


-================================================================================
-= vendor/github.com/juju/ratelimit licensed under: =
-
-All files in this repository are licensed as follows. If you contribute
-to this repository, it is assumed that you license your contribution
-under the same license unless you state otherwise.
-
-All files Copyright (C) 2015 Canonical Ltd. unless otherwise specified in the file.
-
-This software is licensed under the LGPLv3, included below.
-
-As a special exception to the GNU Lesser General Public License version 3
-("LGPL3"), the copyright holders of this Library give you permission to
-convey to a third party a Combined Work that links statically or dynamically
-to this Library without providing any Minimal Corresponding Source or
-Minimal Application Code as set out in 4d or providing the installation
-information set out in section 4e, provided that you comply with the other
-provisions of LGPL3 and provided that you meet, for the Application the
-terms and conditions of the license(s) which apply to the Application.
-
-Except as stated in this special exception, the provisions of LGPL3 will
-continue to comply in full to this Library. If you modify this Library, you
-may apply this exception to your version of this Library, but you are not
-obliged to do so. If you do not wish to do so, delete this exception
-statement from your version. This exception does not (and cannot) modify any
-license terms which apply to the Application, with which you must still
-comply.
-
-
-                   GNU LESSER GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-
-  This version of the GNU Lesser General Public License incorporates
-the terms and conditions of version 3 of the GNU General Public
-License, supplemented by the additional permissions listed below.
-
-  0. Additional Definitions.
-
-  As used herein, "this License" refers to version 3 of the GNU Lesser
-General Public License, and the "GNU GPL" refers to version 3 of the GNU
-General Public License.
-
-  "The Library" refers to a covered work governed by this License,
-other than an Application or a Combined Work as defined below.
-
-  An "Application" is any work that makes use of an interface provided
-by the Library, but which is not otherwise based on the Library.
-Defining a subclass of a class defined by the Library is deemed a mode
-of using an interface provided by the Library.
-
-  A "Combined Work" is a work produced by combining or linking an
-Application with the Library.  The particular version of the Library
-with which the Combined Work was made is also called the "Linked
-Version".
-
-  The "Minimal Corresponding Source" for a Combined Work means the
-Corresponding Source for the Combined Work, excluding any source code
-for portions of the Combined Work that, considered in isolation, are
-based on the Application, and not on the Linked Version.
-
-  The "Corresponding Application Code" for a Combined Work means the
-object code and/or source code for the Application, including any data
-and utility programs needed for reproducing the Combined Work from the
-Application, but excluding the System Libraries of the Combined Work.
-
-  1. Exception to Section 3 of the GNU GPL.
-
-  You may convey a covered work under sections 3 and 4 of this License
-without being bound by section 3 of the GNU GPL.
-
-  2. Conveying Modified Versions.
-
-  If you modify a copy of the Library, and, in your modifications, a
-facility refers to a function or data to be supplied by an Application
-that uses the facility (other than as an argument passed when the
-facility is invoked), then you may convey a copy of the modified
-version:
-
-   a) under this License, provided that you make a good faith effort to
-   ensure that, in the event an Application does not supply the
-   function or data, the facility still operates, and performs
-   whatever part of its purpose remains meaningful, or
-
-   b) under the GNU GPL, with none of the additional permissions of
-   this License applicable to that copy.
-
-  3. Object Code Incorporating Material from Library Header Files.
-
-  The object code form of an Application may incorporate material from
-a header file that is part of the Library.  You may convey such object
-code under terms of your choice, provided that, if the incorporated
-material is not limited to numerical parameters, data structure
-layouts and accessors, or small macros, inline functions and templates
-(ten or fewer lines in length), you do both of the following:
-
-   a) Give prominent notice with each copy of the object code that the
-   Library is used in it and that the Library and its use are
-   covered by this License.
-
-   b) Accompany the object code with a copy of the GNU GPL and this license
-   document.
-
-  4. Combined Works.
-
-  You may convey a Combined Work under terms of your choice that,
-taken together, effectively do not restrict modification of the
-portions of the Library contained in the Combined Work and reverse
-engineering for debugging such modifications, if you also do each of
-the following:
-
-   a) Give prominent notice with each copy of the Combined Work that
-   the Library is used in it and that the Library and its use are
-   covered by this License.
-
-   b) Accompany the Combined Work with a copy of the GNU GPL and this license
-   document.
-
-   c) For a Combined Work that displays copyright notices during
-   execution, include the copyright notice for the Library among
-   these notices, as well as a reference directing the user to the
-   copies of the GNU GPL and this license document.
-
-   d) Do one of the following:
-
-       0) Convey the Minimal Corresponding Source under the terms of this
-       License, and the Corresponding Application Code in a form
-       suitable for, and under terms that permit, the user to
-       recombine or relink the Application with a modified version of
-       the Linked Version to produce a modified Combined Work, in the
-       manner specified by section 6 of the GNU GPL for conveying
-       Corresponding Source.
-
-       1) Use a suitable shared library mechanism for linking with the
-       Library.  A suitable mechanism is one that (a) uses at run time
-       a copy of the Library already present on the user's computer
-       system, and (b) will operate properly with a modified version
-       of the Library that is interface-compatible with the Linked
-       Version.
-
-   e) Provide Installation Information, but only if you would otherwise
-   be required to provide such information under section 6 of the
-   GNU GPL, and only to the extent that such information is
-   necessary to install and execute a modified version of the
-   Combined Work produced by recombining or relinking the
-   Application with a modified version of the Linked Version. (If
-   you use option 4d0, the Installation Information must accompany
-   the Minimal Corresponding Source and Corresponding Application
-   Code. If you use option 4d1, you must provide the Installation
-   Information in the manner specified by section 6 of the GNU GPL
-   for conveying Corresponding Source.)
-
-  5. Combined Libraries.
-
-  You may place library facilities that are a work based on the
-Library side by side in a single library together with other library
-facilities that are not Applications and are not covered by this
-License, and convey such a combined library under terms of your
-choice, if you do both of the following:
-
-   a) Accompany the combined library with a copy of the same work based
-   on the Library, uncombined with any other library facilities,
-   conveyed under the terms of this License.
-
-   b) Give prominent notice with the combined library that part of it
-   is a work based on the Library, and explaining where to find the
-   accompanying uncombined form of the same work.
-
-  6. Revised Versions of the GNU Lesser General Public License.
-
-  The Free Software Foundation may publish revised and/or new versions
-of the GNU Lesser General Public License from time to time. Such new
-versions will be similar in spirit to the present version, but may
-differ in detail to address new problems or concerns.
-
-  Each version is given a distinguishing version number. If the
-Library as you received it specifies that a certain numbered version
-of the GNU Lesser General Public License "or any later version"
-applies to it, you have the option of following the terms and
-conditions either of that published version or of any later version
-published by the Free Software Foundation. If the Library as you
-received it does not specify a version number of the GNU Lesser
-General Public License, you may choose any version of the GNU Lesser
-General Public License ever published by the Free Software Foundation.
-
-  If the Library as you received it specifies that a proxy can decide
-whether future versions of the GNU Lesser General Public License shall
-apply, that proxy's public statement of acceptance of any version is
-permanent authorization for you to choose that version for the
-Library.
-
-= vendor/github.com/juju/ratelimit/LICENSE 2d1c30374313ae40df7772dc92ef9fd5  -
-================================================================================
-
-
 ================================================================================
 = vendor/github.com/kardianos/osext licensed under: =

@ -71689,6 +71490,170 @@ SOFTWARE.
 ================================================================================


+================================================================================
+= vendor/github.com/vmware/photon-controller-go-sdk/photon licensed under: =
+
+				   Apache License
+                    Version 2.0, January 2004
+                http://www.apache.org/licenses/
+
+		
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+(a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
+(b) You must cause any modified files to carry prominent notices stating that You changed the files; and
+(c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+(d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!)  The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or     
+   implied.
+   
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+
+= vendor/github.com/vmware/photon-controller-go-sdk/LICENSE 0de60303c844eac44e45012dac1987de  -
+================================================================================
+
+
+================================================================================
+= vendor/github.com/vmware/photon-controller-go-sdk/photon/lightwave licensed under: =
+
+				   Apache License
+                    Version 2.0, January 2004
+                http://www.apache.org/licenses/
+
+		
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+(a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
+(b) You must cause any modified files to carry prominent notices stating that You changed the files; and
+(c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+(d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!)  The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or     
+   implied.
+   
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+
+= vendor/github.com/vmware/photon-controller-go-sdk/LICENSE 0de60303c844eac44e45012dac1987de  -
+================================================================================
+
+
 ================================================================================
 = vendor/github.com/xanzy/go-cloudstack/cloudstack licensed under: =

--- a/vendor/k8s.io/kubernetes/Makefile
+++ b/vendor/k8s.io/kubernetes/Makefile
@ -95,7 +95,7 @@ ginkgo:
 #   make verify
 #   make verify BRANCH=branch_x
 .PHONY: verify
-verify:
+verify: verify_generated_files
 	KUBE_VERIFY_GIT_BRANCH=$(BRANCH) hack/make-rules/verify.sh -v
 	hack/make-rules/vet.sh

@ -181,7 +181,7 @@ test-e2e: ginkgo generated_files
 # Example:
 #   make test-e2e-node FOCUS=Kubelet SKIP=container
 #   make test-e2e-node REMOTE=true DELETE_INSTANCES=true
-#   make test-e2e-node TEST_ARGS="--cgroups-per-qos=true"
+#   make test-e2e-node TEST_ARGS="--experimental-cgroups-per-qos=true"
 # Build and run tests.
 .PHONY: test-e2e-node
 test-e2e-node: ginkgo generated_files
@ -293,4 +293,12 @@ $(notdir $(abspath $(wildcard federation/cmd/*/))): generated_files
 #   make generated_files
 .PHONY: generated_files
 generated_files:
-	$(MAKE) -f Makefile.$@ $@ CALLED_FROM_MAIN_MAKEFILE=1
+	$(MAKE) -f Makefile.generated_files $@ CALLED_FROM_MAIN_MAKEFILE=1
+
+# Verify auto-generated files needed for the build.
+#
+# Example:
+#   make verify_generated_files
+.PHONY: verify_generated_files
+verify_generated_files:
+	$(MAKE) -f Makefile.generated_files $@ CALLED_FROM_MAIN_MAKEFILE=1
--- a/vendor/k8s.io/kubernetes/Makefile.generated_files
+++ b/vendor/k8s.io/kubernetes/Makefile.generated_files
@ -37,6 +37,12 @@ SHELL := /bin/bash
 .PHONY: generated_files
 generated_files: gen_deepcopy gen_defaulter gen_conversion gen_openapi

+.PHONY: verify_generated_files
+verify_generated_files: verify_gen_deepcopy    \
+                        verify_gen_defaulter   \
+                        verify_gen_conversion  \
+                        verify_gen_openapi
+
 # Code-generation logic.
 #
 # This stuff can be pretty tricky, and there's probably some corner cases that
@ -209,18 +215,30 @@ DEEPCOPY_DIRS := $(shell                                             \
 )
 DEEPCOPY_FILES := $(addsuffix /$(DEEPCOPY_FILENAME), $(DEEPCOPY_DIRS))

+# Shell function for reuse in rules.
+RUN_GEN_DEEPCOPY =                                                          \
+    function run_gen_deepcopy() {                                           \
+        if [[ -f $(META_DIR)/$(DEEPCOPY_GEN).todo ]]; then                  \
+            ./hack/run-in-gopath.sh $(DEEPCOPY_GEN)                         \
+                --v $(KUBE_VERBOSE)                                         \
+                --logtostderr                                               \
+                -i $$(cat $(META_DIR)/$(DEEPCOPY_GEN).todo | paste -sd, -)  \
+                --bounding-dirs $(PRJ_SRC_PATH)                             \
+                -O $(DEEPCOPY_BASENAME)                                     \
+                "$$@";                                                      \
+        fi                                                                  \
+    };                                                                      \
+    run_gen_deepcopy
+
 # This rule aggregates the set of files to generate and then generates them all
 # in a single run of the tool.
 .PHONY: gen_deepcopy
-gen_deepcopy: $(DEEPCOPY_FILES)
-	if [[ -f $(META_DIR)/$(DEEPCOPY_GEN).todo ]]; then                  \
-	    ./hack/run-in-gopath.sh $(DEEPCOPY_GEN)                         \
-	        --v $(KUBE_VERBOSE)                                         \
-	        --logtostderr                                               \
-	        -i $$(cat $(META_DIR)/$(DEEPCOPY_GEN).todo | paste -sd, -)  \
-	        --bounding-dirs $(PRJ_SRC_PATH)                             \
-	        -O $(DEEPCOPY_BASENAME);                                    \
-	fi
+gen_deepcopy: $(DEEPCOPY_FILES) $(DEEPCOPY_GEN)
+	$(RUN_GEN_DEEPCOPY)
+
+.PHONY: verify_gen_deepcopy
+verify_gen_deepcopy: $(DEEPCOPY_GEN)
+	$(RUN_GEN_DEEPCOPY) --verify-only

 # For each dir in DEEPCOPY_DIRS, this establishes a dependency between the
 # output file and the input files that should trigger a rebuild.
@ -323,18 +341,29 @@ DEFAULTER_DIRS := $(shell                                            \

 DEFAULTER_FILES := $(addsuffix /$(DEFAULTER_FILENAME), $(DEFAULTER_DIRS))

+RUN_GEN_DEFAULTER :=                                                         \
+    function run_gen_defaulter() {                                           \
+        if [[ -f $(META_DIR)/$(DEFAULTER_GEN).todo ]]; then                  \
+            ./hack/run-in-gopath.sh $(DEFAULTER_GEN)                         \
+                --v $(KUBE_VERBOSE)                                          \
+                --logtostderr                                                \
+                -i $$(cat $(META_DIR)/$(DEFAULTER_GEN).todo | paste -sd, -)  \
+                --extra-peer-dirs $$(echo $(addprefix $(PRJ_SRC_PATH)/, $(DEFAULTER_DIRS)) | sed 's/ /,/g') \
+                -O $(DEFAULTER_BASENAME)                                     \
+                "$$@";                                                       \
+        fi                                                                   \
+    };                                                                       \
+    run_gen_defaulter
+
 # This rule aggregates the set of files to generate and then generates them all
 # in a single run of the tool.
 .PHONY: gen_defaulter
-gen_defaulter: $(DEFAULTER_FILES)
-	if [[ -f $(META_DIR)/$(DEFAULTER_GEN).todo ]]; then                  \
-	    ./hack/run-in-gopath.sh $(DEFAULTER_GEN)                         \
-	        --v $(KUBE_VERBOSE)                                          \
-	        --logtostderr                                                \
-	        -i $$(cat $(META_DIR)/$(DEFAULTER_GEN).todo | paste -sd, -)  \
-	        --extra-peer-dirs $$(echo $(addprefix $(PRJ_SRC_PATH)/, $(DEFAULTER_DIRS)) | sed 's/ /,/g') \
-	        -O $(DEFAULTER_BASENAME);                                    \
-	fi
+gen_defaulter: $(DEFAULTER_FILES) $(DEFAULTER_GEN)
+	$(RUN_GEN_DEFAULTER)
+
+.PHONY: verify_gen_deepcopy
+verify_gen_defaulter: $(DEFAULTER_GEN)
+	$(RUN_GEN_DEFAULTER) --verify-only

 # For each dir in DEFAULTER_DIRS, this establishes a dependency between the
 # output file and the input files that should trigger a rebuild.
@ -453,9 +482,26 @@ OPENAPI_DIRS := $(shell                                             \

 OPENAPI_OUTFILE := $(OPENAPI_OUTPUT_PKG)/$(OPENAPI_FILENAME)

+# Shell function for reuse in rules.
+RUN_GEN_OPENAPI =                                                                       \
+    function run_gen_openapi() {                                                        \
+        ./hack/run-in-gopath.sh $(OPENAPI_GEN)                                          \
+            --v $(KUBE_VERBOSE)                                                         \
+            --logtostderr                                                               \
+            -i $$(echo $(addprefix $(PRJ_SRC_PATH)/, $(OPENAPI_DIRS)) | sed 's/ /,/g')  \
+            -p $(PRJ_SRC_PATH)/$(OPENAPI_OUTPUT_PKG)                                    \
+            -O $(OPENAPI_BASENAME)                                                      \
+            "$$@";                                                                      \
+    };                                                                                  \
+    run_gen_openapi
+
 # This rule is the user-friendly entrypoint for openapi generation.
 .PHONY: gen_openapi
-gen_openapi: $(OPENAPI_OUTFILE)
+gen_openapi: $(OPENAPI_OUTFILE) $(OPENAPI_GEN)
+
+.PHONY: verify_gen_openapi
+verify_gen_openapi: $(OPENAPI_GEN)
+	$(RUN_GEN_OPENAPI) --verify-only

 # For each dir in OPENAPI_DIRS, this establishes a dependency between the
 # output file and the input files that should trigger a rebuild.
@ -475,13 +521,8 @@ $(foreach dir, $(OPENAPI_DIRS), $(eval                                     \
 ))

 # How to regenerate open-api code.  This emits a single file for all results.
-$(OPENAPI_OUTFILE): $(OPENAPI_GEN)
-	./hack/run-in-gopath.sh $(OPENAPI_GEN)                                          \
-	    --v $(KUBE_VERBOSE)                                                         \
-	    --logtostderr                                                               \
-	    -i $$(echo $(addprefix $(PRJ_SRC_PATH)/, $(OPENAPI_DIRS)) | sed 's/ /,/g')  \
-	    -p $(PRJ_SRC_PATH)/$(OPENAPI_OUTPUT_PKG)                                    \
-	    -O $(OPENAPI_BASENAME)
+$(OPENAPI_OUTFILE): $(OPENAPI_GEN) $(OPENAPI_GEN)
+	$(RUN_GEN_OPENAPI)

 # This calculates the dependencies for the generator tool, so we only rebuild
 # it when needed.  It is PHONY so that it always runs, but it only updates the
@ -560,17 +601,29 @@ CONVERSION_DIRS := $(shell                                              \

 CONVERSION_FILES := $(addsuffix /$(CONVERSION_FILENAME), $(CONVERSION_DIRS))

+# Shell function for reuse in rules.
+RUN_GEN_CONVERSION =                                                          \
+    function run_gen_conversion() {                                           \
+        if [[ -f $(META_DIR)/$(CONVERSION_GEN).todo ]]; then                  \
+            ./hack/run-in-gopath.sh $(CONVERSION_GEN)                         \
+                --v $(KUBE_VERBOSE)                                           \
+                --logtostderr                                                 \
+                -i $$(cat $(META_DIR)/$(CONVERSION_GEN).todo | paste -sd, -)  \
+                -O $(CONVERSION_BASENAME)                                     \
+                "$$@";                                                        \
+        fi                                                                    \
+    };                                                                        \
+    run_gen_conversion
+
 # This rule aggregates the set of files to generate and then generates them all
 # in a single run of the tool.
 .PHONY: gen_conversion
-gen_conversion: $(CONVERSION_FILES)
-	if [[ -f $(META_DIR)/$(CONVERSION_GEN).todo ]]; then                  \
-	    ./hack/run-in-gopath.sh $(CONVERSION_GEN)                         \
-	        --v $(KUBE_VERBOSE)                                           \
-	        --logtostderr                                                 \
-	        -i $$(cat $(META_DIR)/$(CONVERSION_GEN).todo | paste -sd, -)  \
-	        -O $(CONVERSION_BASENAME);                                    \
-	fi
+gen_conversion: $(CONVERSION_FILES) $(CONVERSION_GEN)
+	$(RUN_GEN_CONVERSION)
+
+.PHONY: verify_gen_conversion
+verify_gen_conversion: $(CONVERSION_GEN)
+	$(RUN_GEN_CONVERSION) --verify-only

 # Establish a dependency between the deps file and the dir.  Whenever a dir
 # changes (files added or removed) the deps file will be considered stale.
--- a/vendor/k8s.io/kubernetes/README.md
+++ b/vendor/k8s.io/kubernetes/README.md
@ -32,7 +32,7 @@ Kubernetes builds upon a [decade and a half of experience at Google running prod

 ### Kubernetes is ready for Production!

-With the [1.0.1 release](https://github.com/kubernetes/kubernetes/releases/tag/v1.0.1) Kubernetes is ready to serve your production workloads.
+Since the Kubernetes 1.0 release in July 2015 Kubernetes is ready for your production workloads.

 ### Kubernetes can run anywhere!

@ -68,19 +68,19 @@ Kubernetes documentation is organized into several categories.

  - **Getting started guides**
    - for people who want to create a Kubernetes cluster
-      - in [Creating a Kubernetes Cluster](docs/getting-started-guides/README.md)
+      - in [Creating a Kubernetes Cluster](http://kubernetes.github.io/docs/getting-started-guides/)
    - for people who want to port Kubernetes to a new environment
-      - in [Getting Started from Scratch](docs/getting-started-guides/scratch.md)
+      - in [Getting Started from Scratch](http://kubernetes.github.io/docs/getting-started-guides/scratch/)
  - **User documentation**
    - for people who want to run programs on an existing Kubernetes cluster
-    - in the [Kubernetes User Guide: Managing Applications](docs/user-guide/README.md)
+    - in the [Kubernetes User Guide: Managing Applications](http://kubernetes.github.io/docs/user-guide/)
 	*Tip: You can also view help documentation out on [http://kubernetes.io/docs/](http://kubernetes.io/docs/).*
-    - the [Kubectl Command Line Interface](docs/user-guide/kubectl/kubectl.md) is a detailed reference on
+    - the [Kubectl Command Line Interface](http://kubernetes.io/docs/user-guide/kubectl-overview/) is a detailed reference on
      the `kubectl` CLI
    - [User FAQ](https://github.com/kubernetes/kubernetes/wiki/User-FAQ)
  - **Cluster administrator documentation**
    - for people who want to create a Kubernetes cluster and administer it
-    - in the [Kubernetes Cluster Admin Guide](docs/admin/README.md)
+    - in the [Kubernetes Cluster Admin Guide](http://kubernetes.io/docs/admin/)
  - **Developer and API documentation**
    - for people who want to write programs that access the Kubernetes API, write plugins
      or extensions, or modify the core Kubernetes code
@ -90,7 +90,7 @@ Kubernetes documentation is organized into several categories.
      detailed description of all fields found in the core API objects
  - **Walkthroughs and examples**
    - hands-on introduction and example config files
-    - in the [user guide](docs/user-guide/README.md#quick-walkthrough)
+    - in the [user guide](http://kubernetes.github.io/docs/user-guide/)
    - in the [docs/examples directory](examples/)
  - **Contributions from the Kubernetes community**
    - in the [docs/contrib directory](contrib/)
@ -100,7 +100,7 @@ Kubernetes documentation is organized into several categories.
    - proposals in the [docs/proposals directory](docs/proposals/)
  - **Wiki/FAQ**
    - in the [wiki](https://github.com/kubernetes/kubernetes/wiki)
-    - troubleshooting information in the [troubleshooting guide](docs/troubleshooting.md)
+    - troubleshooting information in the [troubleshooting guide](http://kubernetes.io/docs/troubleshooting/)

 ## Community, discussion, contribution, and support

--- a/vendor/k8s.io/kubernetes/api/openapi-spec/swagger.json
+++ b/vendor/k8s.io/kubernetes/api/openapi-spec/swagger.json
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/apps_v1alpha1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/apps_v1alpha1.json
@ -1452,6 +1452,10 @@
     "azureDisk": {
      "$ref": "v1.AzureDiskVolumeSource",
      "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod."
+     },
+     "photonPersistentDisk": {
+      "$ref": "v1.PhotonPersistentDiskVolumeSource",
+      "description": "PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine"
     }
    }
   },
@ -2085,6 +2089,23 @@
    "id": "v1.AzureDataDiskCachingMode",
    "properties": {}
   },
+   "v1.PhotonPersistentDiskVolumeSource": {
+    "id": "v1.PhotonPersistentDiskVolumeSource",
+    "description": "Represents a Photon Controller persistent disk resource.",
+    "required": [
+     "pdID"
+    ],
+    "properties": {
+     "pdID": {
+      "type": "string",
+      "description": "ID that identifies Photon Controller persistent disk"
+     },
+     "fsType": {
+      "type": "string",
+      "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified."
+     }
+    }
+   },
   "v1.Container": {
    "id": "v1.Container",
    "description": "A single application container that you want to run within a pod.",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/apps_v1beta1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/apps_v1beta1.json
@ -1109,7 +1109,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
@ -1452,6 +1452,10 @@
     "azureDisk": {
      "$ref": "v1.AzureDiskVolumeSource",
      "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod."
+     },
+     "photonPersistentDisk": {
+      "$ref": "v1.PhotonPersistentDiskVolumeSource",
+      "description": "PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine"
     }
    }
   },
@ -2085,6 +2089,23 @@
    "id": "v1.AzureDataDiskCachingMode",
    "properties": {}
   },
+   "v1.PhotonPersistentDiskVolumeSource": {
+    "id": "v1.PhotonPersistentDiskVolumeSource",
+    "description": "Represents a Photon Controller persistent disk resource.",
+    "required": [
+     "pdID"
+    ],
+    "properties": {
+     "pdID": {
+      "type": "string",
+      "description": "ID that identifies Photon Controller persistent disk"
+     },
+     "fsType": {
+      "type": "string",
+      "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified."
+     }
+    }
+   },
   "v1.Container": {
    "id": "v1.Container",
    "description": "A single application container that you want to run within a pod.",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/authentication.k8s.io_v1beta1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/authentication.k8s.io_v1beta1.json
@ -147,7 +147,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/authorization.k8s.io_v1beta1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/authorization.k8s.io_v1beta1.json
@ -245,7 +245,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/autoscaling_v1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/autoscaling_v1.json
@ -1112,7 +1112,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/batch_v1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/batch_v1.json
@ -1112,7 +1112,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
@ -1457,6 +1457,10 @@
     "azureDisk": {
      "$ref": "v1.AzureDiskVolumeSource",
      "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod."
+     },
+     "photonPersistentDisk": {
+      "$ref": "v1.PhotonPersistentDiskVolumeSource",
+      "description": "PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine"
     }
    }
   },
@ -2090,6 +2094,23 @@
    "id": "v1.AzureDataDiskCachingMode",
    "properties": {}
   },
+   "v1.PhotonPersistentDiskVolumeSource": {
+    "id": "v1.PhotonPersistentDiskVolumeSource",
+    "description": "Represents a Photon Controller persistent disk resource.",
+    "required": [
+     "pdID"
+    ],
+    "properties": {
+     "pdID": {
+      "type": "string",
+      "description": "ID that identifies Photon Controller persistent disk"
+     },
+     "fsType": {
+      "type": "string",
+      "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified."
+     }
+    }
+   },
   "v1.Container": {
    "id": "v1.Container",
    "description": "A single application container that you want to run within a pod.",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/certificates.k8s.io_v1alpha1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/certificates.k8s.io_v1alpha1.json
@ -819,7 +819,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/extensions_v1beta1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/extensions_v1beta1.json
@ -7898,7 +7898,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
@ -8224,6 +8224,10 @@
     "azureDisk": {
      "$ref": "v1.AzureDiskVolumeSource",
      "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod."
+     },
+     "photonPersistentDisk": {
+      "$ref": "v1.PhotonPersistentDiskVolumeSource",
+      "description": "PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine"
     }
    }
   },
@ -8857,6 +8861,23 @@
    "id": "v1.AzureDataDiskCachingMode",
    "properties": {}
   },
+   "v1.PhotonPersistentDiskVolumeSource": {
+    "id": "v1.PhotonPersistentDiskVolumeSource",
+    "description": "Represents a Photon Controller persistent disk resource.",
+    "required": [
+     "pdID"
+    ],
+    "properties": {
+     "pdID": {
+      "type": "string",
+      "description": "ID that identifies Photon Controller persistent disk"
+     },
+     "fsType": {
+      "type": "string",
+      "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified."
+     }
+    }
+   },
   "v1.Container": {
    "id": "v1.Container",
    "description": "A single application container that you want to run within a pod.",
@ -10194,7 +10215,7 @@
   },
   "v1beta1.JobList": {
    "id": "v1beta1.JobList",
-    "description": "JobList is a collection of jobs.",
+    "description": "JobList is a collection of jobs. DEPRECATED: extensions/v1beta1.JobList is deprecated, use batch/v1.JobList instead.",
    "required": [
     "items"
    ],
@ -10222,7 +10243,7 @@
   },
   "v1beta1.Job": {
    "id": "v1beta1.Job",
-    "description": "Job represents the configuration of a single job.",
+    "description": "Job represents the configuration of a single job. DEPRECATED: extensions/v1beta1.Job is deprecated, use batch/v1.Job instead.",
    "properties": {
     "kind": {
      "type": "string",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/policy_v1alpha1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/policy_v1alpha1.json
@ -1109,7 +1109,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/policy_v1beta1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/policy_v1beta1.json
@ -1109,7 +1109,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
@ -1236,12 +1236,22 @@
    "id": "v1beta1.PodDisruptionBudgetStatus",
    "description": "PodDisruptionBudgetStatus represents information about the status of a PodDisruptionBudget. Status may trail the actual state of a system.",
    "required": [
+     "disruptedPods",
     "disruptionsAllowed",
     "currentHealthy",
     "desiredHealthy",
     "expectedPods"
    ],
    "properties": {
+     "observedGeneration": {
+      "type": "integer",
+      "format": "int64",
+      "description": "Most recent generation observed when updating this PDB status. PodDisruptionsAllowed and other status informatio is valid only if observedGeneration equals to PDB's object generation."
+     },
+     "disruptedPods": {
+      "type": "object",
+      "description": "DisruptedPods contains information about pods whose eviction was processed by the API server eviction subresource handler but has not yet been observed by the PodDisruptionBudget controller. A pod will be in this map from the time when the API server processed the eviction request to the time when the pod is seen by PDB controller as having been marked for deletion (or after a timeout). The key in the map is the name of the pod and the value is the time when the API server processed the eviction request. If the deletion didn't occur and a pod is still there it will be removed from the list automatically by PodDisruptionBudget controller after some time. If everything goes smooth this map should be empty for the most of the time. Large number of entries in the map may indicate problems with pod deletions."
+     },
     "disruptionsAllowed": {
      "type": "integer",
      "format": "int32",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/rbac.authorization.k8s.io_v1alpha1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/rbac.authorization.k8s.io_v1alpha1.json
@ -2845,7 +2845,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/storage.k8s.io_v1beta1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/storage.k8s.io_v1beta1.json
@ -720,7 +720,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
--- a/vendor/k8s.io/kubernetes/api/swagger-spec/v1.json
+++ b/vendor/k8s.io/kubernetes/api/swagger-spec/v1.json
@ -16254,7 +16254,7 @@
     "deletionTimestamp": {
      "type": "string",
      "format": "date-time",
-      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource will be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. Once the resource is deleted in the API, the Kubelet will send a hard termination signal to the container. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
+      "description": "DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field. Once set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.\n\nPopulated by the system when a graceful deletion is requested. Read-only. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata"
     },
     "deletionGracePeriodSeconds": {
      "type": "integer",
@ -17654,6 +17654,10 @@
      "$ref": "v1.AzureDiskVolumeSource",
      "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod."
     },
+     "photonPersistentDisk": {
+      "$ref": "v1.PhotonPersistentDiskVolumeSource",
+      "description": "PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine"
+     },
     "accessModes": {
      "type": "array",
      "items": {
@ -18104,6 +18108,23 @@
    "id": "v1.AzureDataDiskCachingMode",
    "properties": {}
   },
+   "v1.PhotonPersistentDiskVolumeSource": {
+    "id": "v1.PhotonPersistentDiskVolumeSource",
+    "description": "Represents a Photon Controller persistent disk resource.",
+    "required": [
+     "pdID"
+    ],
+    "properties": {
+     "pdID": {
+      "type": "string",
+      "description": "ID that identifies Photon Controller persistent disk"
+     },
+     "fsType": {
+      "type": "string",
+      "description": "Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". Implicitly inferred to be \"ext4\" if unspecified."
+     }
+    }
+   },
   "v1.PersistentVolumeStatus": {
    "id": "v1.PersistentVolumeStatus",
    "description": "PersistentVolumeStatus is the current status of a persistent volume.",
@ -18362,6 +18383,10 @@
     "azureDisk": {
      "$ref": "v1.AzureDiskVolumeSource",
      "description": "AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod."
+     },
+     "photonPersistentDisk": {
+      "$ref": "v1.PhotonPersistentDiskVolumeSource",
+      "description": "PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine"
     }
    }
   },
--- a/vendor/k8s.io/kubernetes/build-tools/build-image/Dockerfile
+++ b/vendor/k8s.io/kubernetes/build-tools/build-image/Dockerfile
@ -21,6 +21,10 @@ RUN touch /kube-build-image
 # To run as non-root we sometimes need to rebuild go stdlib packages.
 RUN chmod -R a+rwx /usr/local/go/pkg ${K8S_PATCHED_GOROOT}/pkg

+# For running integration tests /var/run/kubernetes is required
+# and should be writable by user
+RUN mkdir /var/run/kubernetes && chmod a+rwx /var/run/kubernetes
+
 # The kubernetes source is expected to be mounted here.  This will be the base
 # of operations.
 ENV HOME /go/src/k8s.io/kubernetes
--- a/vendor/k8s.io/kubernetes/build-tools/build-image/cross/Dockerfile
+++ b/vendor/k8s.io/kubernetes/build-tools/build-image/cross/Dockerfile
@ -15,7 +15,7 @@
 # This file creates a standard build environment for building cross
 # platform go binary for the architecture kubernetes cares about.

-FROM golang:1.7.1
+FROM golang:1.7.3

 ENV GOARM 6
 ENV KUBE_DYNAMIC_CROSSPLATFORMS \
@ -72,7 +72,7 @@ RUN mkdir $TMPDIR \
            github.com/jteeuwen/go-bindata/go-bindata

 # Download and symlink etcd. We need this for our integration tests.
-RUN export ETCD_VERSION=v3.0.13; \
+RUN export ETCD_VERSION=v3.0.14; \
  mkdir -p /usr/local/src/etcd \
  && cd /usr/local/src/etcd \
  && curl -fsSL https://github.com/coreos/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-amd64.tar.gz | tar -xz \
--- a/vendor/k8s.io/kubernetes/build-tools/build-image/cross/VERSION
+++ b/vendor/k8s.io/kubernetes/build-tools/build-image/cross/VERSION
@ -1 +1 @@
-v1.7.1-2
+v1.7.3-0
--- a/vendor/k8s.io/kubernetes/build-tools/lib/release.sh
+++ b/vendor/k8s.io/kubernetes/build-tools/lib/release.sh
@ -83,7 +83,7 @@ function kube::release::package_tarballs() {
  # Clean out any old releases
  rm -rf "${RELEASE_DIR}"
  mkdir -p "${RELEASE_DIR}"
-  kube::release::package_build_image_tarball &
+  kube::release::package_src_tarball &
  kube::release::package_client_tarballs &
  kube::release::package_server_tarballs &
  kube::release::package_salt_tarball &
@ -95,10 +95,20 @@ function kube::release::package_tarballs() {
  kube::util::wait-for-jobs || { kube::log::error "previous tarball phase failed"; return 1; }
 }

-# Package the build image we used from the previous stage, for compliance/licensing/audit/yadda.
-function kube::release::package_build_image_tarball() {
+# Package the source code we built, for compliance/licensing/audit/yadda.
+function kube::release::package_src_tarball() {
  kube::log::status "Building tarball: src"
-  "${TAR}" czf "${RELEASE_DIR}/kubernetes-src.tar.gz" -C "${LOCAL_OUTPUT_BUILD_CONTEXT}" .
+  local source_files=(
+    $(cd "${KUBE_ROOT}" && find . -mindepth 1 -maxdepth 1 \
+      -not \( \
+        \( -path ./_\*        -o \
+           -path ./.git\*     -o \
+           -path ./.config\* -o \
+           -path ./.gsutil\*    \
+        \) -prune \
+      \))
+  )
+  "${TAR}" czf "${RELEASE_DIR}/kubernetes-src.tar.gz" -C "${KUBE_ROOT}" "${source_files[@]}"
 }

 # Package up all of the cross compiled clients. Over time this should grow into
@ -307,6 +317,7 @@ function kube::release::package_kube_manifests_tarball() {
  cp "${salt_dir}/cluster-autoscaler/cluster-autoscaler.manifest" "${dst_dir}/"
  cp "${salt_dir}/fluentd-es/fluentd-es.yaml" "${release_stage}/"
  cp "${salt_dir}/fluentd-gcp/fluentd-gcp.yaml" "${release_stage}/"
+  cp "${salt_dir}/fluentd-gcp-gci/fluentd-gcp-gci.yaml" "${release_stage}/"
  cp "${salt_dir}/kube-registry-proxy/kube-registry-proxy.yaml" "${release_stage}/"
  cp "${salt_dir}/kube-proxy/kube-proxy.manifest" "${release_stage}/"
  cp "${salt_dir}/etcd/etcd.manifest" "${dst_dir}"
--- a/vendor/k8s.io/kubernetes/cluster/addons/addon-manager/kube-addons.sh
+++ b/vendor/k8s.io/kubernetes/cluster/addons/addon-manager/kube-addons.sh
@ -36,7 +36,6 @@ ADDON_CHECK_INTERVAL_SEC=${TEST_ADDON_CHECK_INTERVAL_SEC:-60}
 ADDON_PATH=${ADDON_PATH:-/etc/kubernetes/addons}

 SYSTEM_NAMESPACE=kube-system
-trusty_master=${TRUSTY_MASTER:-false}

 # Remember that you can't log from functions that print some output (because
 # logs are also printed on stdout).
@ -172,7 +171,11 @@ start_addon /opt/namespace.yaml 100 10 "" &
 token_found=""
 while [ -z "${token_found}" ]; do
  sleep .5
-  token_found=$(${KUBECTL} ${KUBECTL_OPTS} get --namespace="${SYSTEM_NAMESPACE}" serviceaccount default -o go-template="{{with index .secrets 0}}{{.name}}{{end}}" || true)
+  token_found=$(${KUBECTL} ${KUBECTL_OPTS} get --namespace="${SYSTEM_NAMESPACE}" serviceaccount default -o go-template="{{with index .secrets 0}}{{.name}}{{end}}")
+  if [[ $? -ne 0 ]]; then
+    token_found="";
+    log WRN "== Error getting default service account, retry in 0.5 second =="
+  fi
 done

 log INFO "== Default service account in the ${SYSTEM_NAMESPACE} namespace has token ${token_found} =="
--- a/vendor/k8s.io/kubernetes/cluster/addons/calico-policy-controller/calico-etcd-statefulset.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/addons/calico-policy-controller/calico-etcd-statefulset.yaml
--- a/vendor/k8s.io/kubernetes/cluster/addons/cluster-loadbalancing/glbc/default-svc-controller.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/addons/cluster-loadbalancing/glbc/default-svc-controller.yaml
@ -1,25 +1,22 @@
-apiVersion: v1
-kind: ReplicationController
+apiVersion: extensions/v1beta1
+kind: Deployment
 metadata:
-  name: l7-default-backend-v1.0
+  name: l7-default-backend
  namespace: kube-system
  labels:
    k8s-app: glbc
-    version: v1.0
-    kubernetes.io/cluster-service: "true"
    kubernetes.io/name: "GLBC"
+    kubernetes.io/cluster-service: "true"
 spec:
  replicas: 1
  selector:
-    k8s-app: glbc
-    version: v1.0
+    matchLabels:
+      k8s-app: glbc
  template:
    metadata:
      labels:
        k8s-app: glbc
-        version: v1.0
        name: glbc
-        kubernetes.io/cluster-service: "true"
    spec:
      containers:
      - name: default-http-backend
--- a/vendor/k8s.io/kubernetes/cluster/addons/cluster-monitoring/google/heapster-controller.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/addons/cluster-monitoring/google/heapster-controller.yaml
@ -1,9 +1,6 @@
 {% set base_metrics_memory = "140Mi" -%}
-{% set metrics_memory = base_metrics_memory -%}
 {% set base_metrics_cpu = "80m" -%}
-{% set metrics_cpu = base_metrics_cpu -%}
 {% set base_eventer_memory = "190Mi" -%}
-{% set eventer_memory = base_eventer_memory -%}
 {% set metrics_memory_per_node = 4 -%}
 {% set metrics_cpu_per_node = 0.5 -%}
 {% set eventer_memory_per_node = 500 -%}
@ -11,9 +8,6 @@
 {% set nanny_memory = "90Mi" -%}
 {% set nanny_memory_per_node = 200 -%}
 {% if num_nodes >= 0 -%}
-  {% set metrics_memory = (200 + num_nodes * metrics_memory_per_node)|string + "Mi" -%}
-  {% set metrics_cpu = (80 + num_nodes * metrics_cpu_per_node)|string + "m" -%}
-  {% set eventer_memory = (200 * 1024 + num_nodes * eventer_memory_per_node)|string + "Ki" -%}
  {% set nanny_memory = (90 * 1024 + num_nodes * nanny_memory_per_node)|string + "Ki" -%}
 {% endif -%}

@ -51,14 +45,6 @@ spec:
              scheme: HTTP
            initialDelaySeconds: 180
            timeoutSeconds: 5
-          resources:
-            # keep request = limit to keep this container in guaranteed class
-            limits:
-              cpu: {{ metrics_cpu }}
-              memory: {{ metrics_memory }}
-            requests:
-              cpu: {{ metrics_cpu }}
-              memory: {{ metrics_memory }}
          command:
            - /heapster
            - --source=kubernetes.summary_api:''
@ -69,14 +55,6 @@ spec:
              readOnly: true
        - image: gcr.io/google_containers/heapster:v1.2.0
          name: eventer
-          resources:
-            # keep request = limit to keep this container in guaranteed class
-            limits:
-              cpu: 100m
-              memory: {{ eventer_memory }}
-            requests:
-              cpu: 100m
-              memory: {{ eventer_memory }}
          command:
            - /eventer
            - --source=kubernetes:''
--- a/vendor/k8s.io/kubernetes/cluster/addons/cluster-monitoring/googleinfluxdb/heapster-controller-combined.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/addons/cluster-monitoring/googleinfluxdb/heapster-controller-combined.yaml
@ -1,9 +1,6 @@
 {% set base_metrics_memory = "140Mi" -%}
-{% set metrics_memory = base_metrics_memory -%}
 {% set base_metrics_cpu = "80m" -%}
-{% set metrics_cpu = base_metrics_cpu -%}
 {% set base_eventer_memory = "190Mi" -%}
-{% set eventer_memory = base_eventer_memory -%}
 {% set metrics_memory_per_node = 4 -%}
 {% set metrics_cpu_per_node = 0.5 -%}
 {% set eventer_memory_per_node = 500 -%}
@ -11,9 +8,6 @@
 {% set nanny_memory = "90Mi" -%}
 {% set nanny_memory_per_node = 200 -%}
 {% if num_nodes >= 0 -%}
-  {% set metrics_memory = (200 + num_nodes * metrics_memory_per_node)|string + "Mi" -%}
-  {% set metrics_cpu = (80 + num_nodes * metrics_cpu_per_node)|string + "m" -%}
-  {% set eventer_memory = (200 * 1024 + num_nodes * eventer_memory_per_node)|string + "Ki" -%}
  {% set nanny_memory = (90 * 1024 + num_nodes * nanny_memory_per_node)|string + "Ki" -%}
 {% endif -%}

@ -51,14 +45,6 @@ spec:
              scheme: HTTP
            initialDelaySeconds: 180
            timeoutSeconds: 5
-          resources:
-            # keep request = limit to keep this container in guaranteed class
-            limits:
-              cpu: {{ metrics_cpu }}
-              memory: {{ metrics_memory }}
-            requests:
-              cpu: {{ metrics_cpu }}
-              memory: {{ metrics_memory }}
          command:
            - /heapster
            - --source=kubernetes.summary_api:''
@ -70,14 +56,6 @@ spec:
              readOnly: true
        - image: gcr.io/google_containers/heapster:v1.2.0
          name: eventer
-          resources:
-            # keep request = limit to keep this container in guaranteed class
-            limits:
-              cpu: 100m
-              memory: {{ eventer_memory }}
-            requests:
-              cpu: 100m
-              memory: {{ eventer_memory }}
          command:
            - /eventer
            - --source=kubernetes:''
--- a/vendor/k8s.io/kubernetes/cluster/addons/cluster-monitoring/influxdb/heapster-controller.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/addons/cluster-monitoring/influxdb/heapster-controller.yaml
@ -1,9 +1,6 @@
 {% set base_metrics_memory = "140Mi" -%}
-{% set metrics_memory = base_metrics_memory -%}
 {% set base_metrics_cpu = "80m" -%}
-{% set metrics_cpu = base_metrics_cpu -%}
 {% set base_eventer_memory = "190Mi" -%}
-{% set eventer_memory = base_eventer_memory -%}
 {% set metrics_memory_per_node = 4 -%}
 {% set metrics_cpu_per_node = 0.5|float -%}
 {% set eventer_memory_per_node = 500 -%}
@ -11,9 +8,6 @@
 {% set nanny_memory = "90Mi" -%}
 {% set nanny_memory_per_node = 200 -%}
 {% if num_nodes >= 0 -%}
-  {% set metrics_memory = (200 + num_nodes * metrics_memory_per_node)|string + "Mi" -%}
-  {% set metrics_cpu = (80 + num_nodes * metrics_cpu_per_node)|string + "m" -%}
-  {% set eventer_memory = (200 * 1024 + num_nodes * eventer_memory_per_node)|string + "Ki" -%}
  {% set nanny_memory = (90 * 1024 + num_nodes * nanny_memory_per_node)|string + "Ki" -%}
 {% endif -%}

@ -51,28 +45,12 @@ spec:
              scheme: HTTP
            initialDelaySeconds: 180
            timeoutSeconds: 5
-          resources:
-            # keep request = limit to keep this container in guaranteed class
-            limits:
-              cpu: {{ metrics_cpu }}
-              memory: {{ metrics_memory }}
-            requests:
-              cpu: {{ metrics_cpu }}
-              memory: {{ metrics_memory }}
          command:
            - /heapster
            - --source=kubernetes.summary_api:''
            - --sink=influxdb:http://monitoring-influxdb:8086
        - image: gcr.io/google_containers/heapster:v1.2.0
          name: eventer
-          resources:
-            # keep request = limit to keep this container in guaranteed class
-            limits:
-              cpu: 100m
-              memory: {{ eventer_memory }}
-            requests:
-              cpu: 100m
-              memory: {{ eventer_memory }}
          command:
            - /eventer
            - --source=kubernetes:''
--- a/vendor/k8s.io/kubernetes/cluster/addons/cluster-monitoring/standalone/heapster-controller.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/addons/cluster-monitoring/standalone/heapster-controller.yaml
@ -1,16 +1,12 @@
 {% set base_metrics_memory = "140Mi" -%}
-{% set metrics_memory = base_metrics_memory -%}
 {% set metrics_memory_per_node = 4 -%}
 {% set base_metrics_cpu = "80m" -%}
-{% set metrics_cpu = base_metrics_cpu -%}
 {% set metrics_cpu_per_node = 0.5 -%}
 {% set num_nodes = pillar.get('num_nodes', -1) -%}
 {% set nanny_memory = "90Mi" -%}
 {% set nanny_memory_per_node = 200 -%}
 {% if num_nodes >= 0 -%}
-  {% set metrics_memory = (200 + num_nodes * metrics_memory_per_node)|string + "Mi" -%}
  {% set nanny_memory = (90 * 1024 + num_nodes * nanny_memory_per_node)|string + "Ki" -%}
-  {% set metrics_cpu = (80 + num_nodes * metrics_cpu_per_node)|string + "m" -%}
 {% endif -%}

 apiVersion: extensions/v1beta1
@ -47,14 +43,6 @@ spec:
              scheme: HTTP
            initialDelaySeconds: 180
            timeoutSeconds: 5
-          resources:
-            # keep request = limit to keep this container in guaranteed class
-            limits:
-              cpu: {{ metrics_cpu }}
-              memory: {{ metrics_memory }}
-            requests:
-              cpu: {{ metrics_cpu }}
-              memory: {{ metrics_memory }}
          command:
            - /heapster
            - --source=kubernetes.summary_api:''
--- a/vendor/k8s.io/kubernetes/cluster/addons/dashboard/dashboard-controller.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/addons/dashboard/dashboard-controller.yaml
@ -1,30 +1,27 @@
 # This file should be kept in sync with cluster/gce/coreos/kube-manifests/addons/dashboard/dashboard-controller.yaml
-apiVersion: v1
-kind: ReplicationController
+apiVersion: extensions/v1beta1
+kind: Deployment
 metadata:
-  name: kubernetes-dashboard-v1.4.0
+  name: kubernetes-dashboard
  namespace: kube-system
  labels:
    k8s-app: kubernetes-dashboard
-    version: v1.4.0
    kubernetes.io/cluster-service: "true"
 spec:
-  replicas: 1
  selector:
-    k8s-app: kubernetes-dashboard
+    matchLabels:
+      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
-        version: v1.4.0
-        kubernetes.io/cluster-service: "true"
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
    spec:
      containers:
      - name: kubernetes-dashboard
-        image: gcr.io/google_containers/kubernetes-dashboard-amd64:v1.4.0
+        image: gcr.io/google_containers/kubernetes-dashboard-amd64:v1.4.2
        resources:
          # keep request = limit to keep this container in guaranteed class
          limits:
--- a/vendor/k8s.io/kubernetes/cluster/addons/dns-horizontal-autoscaler/dns-horizontal-autoscaler.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/addons/dns-horizontal-autoscaler/dns-horizontal-autoscaler.yaml
@ -0,0 +1,50 @@
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: kube-dns-autoscaler
+  namespace: kube-system
+  labels:
+    k8s-app: kube-dns-autoscaler
+    kubernetes.io/cluster-service: "true"
+spec:
+  template:
+    metadata:
+      labels:
+        k8s-app: kube-dns-autoscaler
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ''
+        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
+    spec:
+      containers:
+      - name: autoscaler
+        image: gcr.io/google_containers/cluster-proportional-autoscaler-amd64:1.0.0
+        resources:
+            requests:
+                cpu: "20m"
+                memory: "10Mi"
+        command:
+          - /cluster-proportional-autoscaler
+          - --namespace=kube-system
+          - --configmap=kube-dns-autoscaler
+          - --mode=linear
+          # Should keep target in sync with cluster/addons/dns/skydns-rc.yaml.base
+          - --target=Deployment/kube-dns
+          # When cluster is using large nodes(with more cores), "coresPerReplica" should dominate.
+          # If using small nodes, "nodesPerReplica" should dominate.
+          - --default-params={"linear":{"coresPerReplica":256,"nodesPerReplica":16,"min":1}}
+          - --logtostderr=true
+          - --v=2
--- a/vendor/k8s.io/kubernetes/cluster/addons/dns/skydns-rc.yaml.base
+++ b/vendor/k8s.io/kubernetes/cluster/addons/dns/skydns-rc.yaml.base
@ -13,28 +13,31 @@
 # limitations under the License.

 # TODO - At some point, we need to rename all skydns-*.yaml.* files to kubedns-*.yaml.*
+# Should keep target in cluster/addons/dns-horizontal-autoscaler/dns-horizontal-autoscaler.yaml
+# in sync with this file.

 # __MACHINE_GENERATED_WARNING__

-apiVersion: v1
-kind: ReplicationController
+apiVersion: extensions/v1beta1
+kind: Deployment
 metadata:
-  name: kube-dns-v20
+  name: kube-dns
  namespace: kube-system
  labels:
    k8s-app: kube-dns
-    version: v20
    kubernetes.io/cluster-service: "true"
 spec:
-  replicas: __PILLAR__DNS__REPLICAS__
+  # replicas: not specified here:
+  # 1. In order to make Addon Manager do not reconcile this replicas parameter.
+  # 2. Default is 1.
+  # 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
  selector:
-    k8s-app: kube-dns
-    version: v20
+    matchLabels:
+      k8s-app: kube-dns
  template:
    metadata:
      labels:
        k8s-app: kube-dns
-        version: v20
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
@ -71,10 +74,15 @@ spec:
          initialDelaySeconds: 3
          timeoutSeconds: 5
        args:
-        # command = "/kube-dns"
        - --domain=__PILLAR__DNS__DOMAIN__.
        - --dns-port=10053
+        # This should be set to v=2 only after the new image (cut from 1.5) has
+        # been released, otherwise we will flood the logs.
+        - --v=0
        __PILLAR__FEDERATIONS__DOMAIN__MAP__
+        env:
+        - name: PROMETHEUS_PORT
+          value: "10055"
        ports:
        - containerPort: 10053
          name: dns-local
@ -82,6 +90,9 @@ spec:
        - containerPort: 10053
          name: dns-tcp-local
          protocol: TCP
+        - containerPort: 10055
+          name: metrics
+          protocol: TCP
      - name: dnsmasq
        image: gcr.io/google_containers/kube-dnsmasq-amd64:1.4
        livenessProbe:
@ -105,6 +116,32 @@ spec:
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
+        # see: https://github.com/kubernetes/kubernetes/issues/29055 for details
+        resources:
+          requests:
+            cpu: 150m
+            memory: 10Mi
+      - name: dnsmasq-metrics
+        image: gcr.io/google_containers/dnsmasq-metrics-amd64:1.0
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 10054
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        args:
+        - --v=2
+        - --logtostderr
+        ports:
+        - containerPort: 10054
+          name: metrics
+          protocol: TCP
+        resources:
+          requests:
+            memory: 10Mi
      - name: healthz
        image: gcr.io/google_containers/exechealthz-amd64:1.2
        resources:
--- a/vendor/k8s.io/kubernetes/cluster/addons/dns/skydns-rc.yaml.in
+++ b/vendor/k8s.io/kubernetes/cluster/addons/dns/skydns-rc.yaml.in
@ -13,28 +13,31 @@
 # limitations under the License.

 # TODO - At some point, we need to rename all skydns-*.yaml.* files to kubedns-*.yaml.*
+# Should keep target in cluster/addons/dns-horizontal-autoscaler/dns-horizontal-autoscaler.yaml
+# in sync with this file.

 # Warning: This is a file generated from the base underscore template file: skydns-rc.yaml.base

-apiVersion: v1
-kind: ReplicationController
+apiVersion: extensions/v1beta1
+kind: Deployment
 metadata:
-  name: kube-dns-v20
+  name: kube-dns
  namespace: kube-system
  labels:
    k8s-app: kube-dns
-    version: v20
    kubernetes.io/cluster-service: "true"
 spec:
-  replicas: {{ pillar['dns_replicas'] }}
+  # replicas: not specified here:
+  # 1. In order to make Addon Manager do not reconcile this replicas parameter.
+  # 2. Default is 1.
+  # 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
  selector:
-    k8s-app: kube-dns
-    version: v20
+    matchLabels:
+      k8s-app: kube-dns
  template:
    metadata:
      labels:
        k8s-app: kube-dns
-        version: v20
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
@ -71,10 +74,15 @@ spec:
          initialDelaySeconds: 3
          timeoutSeconds: 5
        args:
-        # command = "/kube-dns"
        - --domain={{ pillar['dns_domain'] }}.
        - --dns-port=10053
+        # This should be set to v=2 only after the new image (cut from 1.5) has
+        # been released, otherwise we will flood the logs.
+        - --v=0
        {{ pillar['federations_domain_map'] }}
+        env:
+        - name: PROMETHEUS_PORT
+          value: "10055"
        ports:
        - containerPort: 10053
          name: dns-local
@ -82,6 +90,9 @@ spec:
        - containerPort: 10053
          name: dns-tcp-local
          protocol: TCP
+        - containerPort: 10055
+          name: metrics
+          protocol: TCP
      - name: dnsmasq
        image: gcr.io/google_containers/kube-dnsmasq-amd64:1.4
        livenessProbe:
@ -105,6 +116,32 @@ spec:
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
+        # see: https://github.com/kubernetes/kubernetes/issues/29055 for details
+        resources:
+          requests:
+            cpu: 150m
+            memory: 10Mi
+      - name: dnsmasq-metrics
+        image: gcr.io/google_containers/dnsmasq-metrics-amd64:1.0
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 10054
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        args:
+        - --v=2
+        - --logtostderr
+        ports:
+        - containerPort: 10054
+          name: metrics
+          protocol: TCP
+        resources:
+          requests:
+            memory: 10Mi
      - name: healthz
        image: gcr.io/google_containers/exechealthz-amd64:1.2
        resources:
--- a/vendor/k8s.io/kubernetes/cluster/addons/dns/skydns-rc.yaml.sed
+++ b/vendor/k8s.io/kubernetes/cluster/addons/dns/skydns-rc.yaml.sed
@ -13,28 +13,31 @@
 # limitations under the License.

 # TODO - At some point, we need to rename all skydns-*.yaml.* files to kubedns-*.yaml.*
+# Should keep target in cluster/addons/dns-horizontal-autoscaler/dns-horizontal-autoscaler.yaml
+# in sync with this file.

 # Warning: This is a file generated from the base underscore template file: skydns-rc.yaml.base

-apiVersion: v1
-kind: ReplicationController
+apiVersion: extensions/v1beta1
+kind: Deployment
 metadata:
-  name: kube-dns-v20
+  name: kube-dns
  namespace: kube-system
  labels:
    k8s-app: kube-dns
-    version: v20
    kubernetes.io/cluster-service: "true"
 spec:
-  replicas: $DNS_REPLICAS
+  # replicas: not specified here:
+  # 1. In order to make Addon Manager do not reconcile this replicas parameter.
+  # 2. Default is 1.
+  # 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
  selector:
-    k8s-app: kube-dns
-    version: v20
+    matchLabels:
+      k8s-app: kube-dns
  template:
    metadata:
      labels:
        k8s-app: kube-dns
-        version: v20
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
@ -71,9 +74,14 @@ spec:
          initialDelaySeconds: 3
          timeoutSeconds: 5
        args:
-        # command = "/kube-dns"
        - --domain=$DNS_DOMAIN.
        - --dns-port=10053
+        # This should be set to v=2 only after the new image (cut from 1.5) has
+        # been released, otherwise we will flood the logs.
+        - --v=0
+        env:
+        - name: PROMETHEUS_PORT
+          value: "10055"
        ports:
        - containerPort: 10053
          name: dns-local
@ -81,6 +89,9 @@ spec:
        - containerPort: 10053
          name: dns-tcp-local
          protocol: TCP
+        - containerPort: 10055
+          name: metrics
+          protocol: TCP
      - name: dnsmasq
        image: gcr.io/google_containers/kube-dnsmasq-amd64:1.4
        livenessProbe:
@ -104,6 +115,32 @@ spec:
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
+        # see: https://github.com/kubernetes/kubernetes/issues/29055 for details
+        resources:
+          requests:
+            cpu: 150m
+            memory: 10Mi
+      - name: dnsmasq-metrics
+        image: gcr.io/google_containers/dnsmasq-metrics-amd64:1.0
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 10054
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        args:
+        - --v=2
+        - --logtostderr
+        ports:
+        - containerPort: 10054
+          name: metrics
+          protocol: TCP
+        resources:
+          requests:
+            memory: 10Mi
      - name: healthz
        image: gcr.io/google_containers/exechealthz-amd64:1.2
        resources:
--- a/vendor/k8s.io/kubernetes/cluster/addons/dns/transforms2salt.sed
+++ b/vendor/k8s.io/kubernetes/cluster/addons/dns/transforms2salt.sed
@ -1,5 +1,4 @@
 s/__PILLAR__DNS__SERVER__/{{ pillar['dns_server'] }}/g
-s/__PILLAR__DNS__REPLICAS__/{{ pillar['dns_replicas'] }}/g
 s/__PILLAR__DNS__DOMAIN__/{{ pillar['dns_domain'] }}/g
 s/__PILLAR__FEDERATIONS__DOMAIN__MAP__/{{ pillar['federations_domain_map'] }}/g
-s/__MACHINE_GENERATED_WARNING__/Warning: This is a file generated from the base underscore template file: __SOURCE_FILENAME__/g
+s/__MACHINE_GENERATED_WARNING__/Warning: This is a file generated from the base underscore template file: __SOURCE_FILENAME__/g
--- a/vendor/k8s.io/kubernetes/cluster/addons/dns/transforms2sed.sed
+++ b/vendor/k8s.io/kubernetes/cluster/addons/dns/transforms2sed.sed
@ -1,5 +1,4 @@
 s/__PILLAR__DNS__SERVER__/$DNS_SERVER_IP/g
-s/__PILLAR__DNS__REPLICAS__/$DNS_REPLICAS/g
 s/__PILLAR__DNS__DOMAIN__/$DNS_DOMAIN/g
 /__PILLAR__FEDERATIONS__DOMAIN__MAP__/d
-s/__MACHINE_GENERATED_WARNING__/Warning: This is a file generated from the base underscore template file: __SOURCE_FILENAME__/g
+s/__MACHINE_GENERATED_WARNING__/Warning: This is a file generated from the base underscore template file: __SOURCE_FILENAME__/g
--- a/vendor/k8s.io/kubernetes/cluster/addons/fluentd-elasticsearch/fluentd-es-image/Dockerfile
+++ b/vendor/k8s.io/kubernetes/cluster/addons/fluentd-elasticsearch/fluentd-es-image/Dockerfile
@ -38,5 +38,7 @@ COPY td-agent.conf /etc/td-agent/td-agent.conf
 COPY build.sh /tmp/build.sh
 RUN /tmp/build.sh

+ENV LD_PRELOAD /opt/td-agent/embedded/lib/libjemalloc.so
+
 # Run the Fluentd service.
 ENTRYPOINT ["td-agent"]
--- a/vendor/k8s.io/kubernetes/cluster/addons/fluentd-elasticsearch/fluentd-es-image/td-agent.conf
+++ b/vendor/k8s.io/kubernetes/cluster/addons/fluentd-elasticsearch/fluentd-es-image/td-agent.conf
@ -144,7 +144,6 @@
 <source>
  type tail
  format /^time="(?<time>[^)]*)" level=(?<severity>[^ ]*) msg="(?<message>[^"]*)"( err="(?<error>[^"]*)")?( statusCode=($<status_code>\d+))?/
-  time_format %Y-%m-%dT%H:%M:%S.%NZ
  path /var/log/docker.log
  pos_file /var/log/es-docker.log.pos
  tag docker
@ -218,6 +217,19 @@
  tag kube-scheduler
 </source>

+# Example:
+# I1104 10:36:20.242766       5 rescheduler.go:73] Running Rescheduler
+<source>
+  type tail
+  format multiline
+  format_firstline /^\w\d{4}/
+  format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
+  time_format %m%d %H:%M:%S.%N
+  path /var/log/rescheduler.log
+  pos_file /var/log/es-rescheduler.log.pos
+  tag rescheduler
+</source>
+
 #<filter kubernetes.**>
 #  type kubernetes_metadata
 #</filter>
--- a/vendor/k8s.io/kubernetes/cluster/addons/fluentd-elasticsearch/kibana-controller.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/addons/fluentd-elasticsearch/kibana-controller.yaml
@ -1,23 +1,20 @@
-apiVersion: v1
-kind: ReplicationController
+apiVersion: extensions/v1beta1
+kind: Deployment
 metadata:
-  name: kibana-logging-v1
+  name: kibana-logging
  namespace: kube-system
  labels:
    k8s-app: kibana-logging
-    version: v1
    kubernetes.io/cluster-service: "true"
 spec:
  replicas: 1
  selector:
-    k8s-app: kibana-logging
-    version: v1
+    matchLabels:
+      k8s-app: kibana-logging
  template:
    metadata:
      labels:
        k8s-app: kibana-logging
-        version: v1
-        kubernetes.io/cluster-service: "true"
    spec:
      containers:
      - name: kibana-logging
--- a/vendor/k8s.io/kubernetes/cluster/addons/fluentd-elasticsearch/kibana-image/run.sh
+++ b/vendor/k8s.io/kubernetes/cluster/addons/fluentd-elasticsearch/kibana-image/run.sh
@ -17,7 +17,7 @@
 export ELASTICSEARCH_URL=${ELASTICSEARCH_URL:-"http://localhost:9200"}
 echo ELASTICSEARCH_URL=${ELASTICSEARCH_URL}

-export KIBANA_BASE_URL=${KIBANA_BASE_URL:-""}
+export KIBANA_BASE_URL=${KIBANA_BASE_URL:-"''"}
 echo "server.basePath: ${KIBANA_BASE_URL}"
 echo "server.basePath: ${KIBANA_BASE_URL}" >> /kibana/config/kibana.yml

--- a/vendor/k8s.io/kubernetes/cluster/addons/fluentd-gcp/fluentd-gcp-image/Dockerfile
+++ b/vendor/k8s.io/kubernetes/cluster/addons/fluentd-gcp/fluentd-gcp-image/Dockerfile
@ -21,36 +21,40 @@
 # in the Google Developer Console.

 FROM gcr.io/google_containers/ubuntu-slim:0.4
-MAINTAINER Alex Robinson "arob@google.com"

-# Disable prompts from apt.
+MAINTAINER Mik Vyatskov "vmik@google.com"
+
+# Disable prompts from apt
 ENV DEBIAN_FRONTEND noninteractive
-# Keeps unneeded configs from being installed along with fluentd.
-ENV DO_NOT_INSTALL_CATCH_ALL_CONFIG true

-RUN apt-get -q update && \
-    apt-get install -y curl ca-certificates gcc make bash && \
-    apt-get install -y --reinstall lsb-base lsb-release && \
-    echo "Installing logging agent" && \
-    curl -sSL https://dl.google.com/cloudagents/install-logging-agent.sh | bash && \
-    /usr/sbin/google-fluentd-gem install fluent-plugin-record-reformer -v 0.8.1  && \
-    /usr/sbin/google-fluentd-gem install fluent-plugin-systemd -v 0.0.3 && \
-    apt-get remove -y gcc make && \
-    apt-get autoremove -y && \
-    apt-get clean && \
+# Install build tools
+RUN apt-get -qq update && \
+    apt-get install -y -qq curl ca-certificates gcc make bash sudo && \
+    apt-get install -y -qq --reinstall lsb-base lsb-release && \
+    # Install logging agent and required gems
+    /usr/bin/curl -sSL https://toolbelt.treasuredata.com/sh/install-ubuntu-xenial-td-agent2.sh | sh && \
+    sed -i -e "s/USER=td-agent/USER=root/" -e "s/GROUP=td-agent/GROUP=root/" /etc/init.d/td-agent && \
+    td-agent-gem install --no-document fluent-plugin-record-reformer -v 0.8.2 && \
+    td-agent-gem install --no-document fluent-plugin-systemd -v 0.0.5 && \
+    td-agent-gem install --no-document fluent-plugin-google-cloud -v 0.5.2 && \
+    # Remove build tools
+    apt-get remove -y -qq gcc make && \
+    apt-get autoremove -y -qq && \
+    apt-get clean -qq && \
+    # Remove unnecessary files
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
-    /opt/google-fluentd/embedded/share/doc \
-    /opt/google-fluentd/embedded/share/gtk-doc \
-    /opt/google-fluentd/embedded/lib/postgresql \
-    /opt/google-fluentd/embedded/bin/postgres \
-    /opt/google-fluentd/embedded/share/postgresql \
-    /var/log/google-fluentd
+        /opt/td-agent/embedded/share/doc \
+        /opt/td-agent/embedded/share/gtk-doc \
+        /opt/td-agent/embedded/lib/postgresql \
+        /opt/td-agent/embedded/bin/postgres \
+        /opt/td-agent/embedded/share/postgresql \
+        /etc/td-agent/td-agent.conf

 # Copy the Fluentd configuration files for logging Docker container logs.
 # Either configuration file can be used by specifying `-c <file>` as a command
 # line argument.
-COPY google-fluentd.conf /etc/google-fluentd/google-fluentd.conf
-COPY google-fluentd-journal.conf /etc/google-fluentd/google-fluentd-journal.conf
+COPY google-fluentd.conf /etc/td-agent/td-agent.conf
+COPY google-fluentd-journal.conf /etc/td-agent/td-agent-journal.conf

 # Start Fluentd to pick up our config that watches Docker container logs.
-CMD /usr/sbin/google-fluentd "$FLUENTD_ARGS"
+CMD /usr/sbin/td-agent $FLUENTD_ARGS
--- a/vendor/k8s.io/kubernetes/cluster/addons/fluentd-gcp/fluentd-gcp-image/Makefile
+++ b/vendor/k8s.io/kubernetes/cluster/addons/fluentd-gcp/fluentd-gcp-image/Makefile
@ -26,25 +26,14 @@
 # 6. When PR is approved make the gcr.io version of the image: make build push
 # 7. Revert the referendes to kubernetes/fluentd-gcp:$(TAG) to gcr.io/google_containers/fluentd-gcp:$(TAG)

-.PHONY:	kbuild kpush
+.PHONY:	build push

-TAG = 1.25
-
-# Rules for building the test image for deployment to Dockerhub with user kubernetes.
-
-kbuild:
-	docker build -t kubernetes/fluentd-gcp:$(TAG) .
-
-
-kpush:
-	docker push kubernetes/fluentd-gcp:$(TAG)
-
-
-# Rules for building the real image for deployment to gcr.io
+PREFIX=gcr.io/google_containers
+TAG = 1.26

 build:
-	docker build -t gcr.io/google_containers/fluentd-gcp:$(TAG) .
+	docker build -t $(PREFIX)/fluentd-gcp:$(TAG) .


 push:
-	gcloud docker -- push gcr.io/google_containers/fluentd-gcp:$(TAG)
+	gcloud docker -- push $(PREFIX)/fluentd-gcp:$(TAG)
--- a/vendor/k8s.io/kubernetes/cluster/addons/fluentd-gcp/fluentd-gcp-image/google-fluentd-journal.conf
+++ b/vendor/k8s.io/kubernetes/cluster/addons/fluentd-gcp/fluentd-gcp-image/google-fluentd-journal.conf
@ -93,7 +93,6 @@
 <source>
  type tail
  format /^time="(?<time>[^)]*)" level=(?<severity>[^ ]*) msg="(?<message>[^"]*)"( err="(?<error>[^"]*)")?( statusCode=($<status_code>\d+))?/
-  time_format %Y-%m-%dT%H:%M:%S.%NZ
  path /var/log/docker.log
  pos_file /var/log/gcp-docker.log.pos
  tag docker
@ -171,6 +170,20 @@
  tag kube-scheduler
 </source>

+# Example:
+# I1104 10:36:20.242766       5 rescheduler.go:73] Running Rescheduler
+<source>
+  type tail
+  format multiline
+  multiline_flush_interval 5s
+  format_firstline /^\w\d{4}/
+  format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
+  time_format %m%d %H:%M:%S.%N
+  path /var/log/rescheduler.log
+  pos_file /var/log/gcp-rescheduler.log.pos
+  tag rescheduler
+</source>
+
 # Example:
 # I0603 15:31:05.793605       6 cluster_manager.go:230] Reading config from path /etc/gce.conf
 <source>
@ -222,12 +235,18 @@
 # them separate since most users don't care about the node logs.
 <match kubernetes.**>
  type google_cloud
+  # Set the buffer type to file to improve the reliability and reduce the memory consumption
+  buffer_type file
+  buffer_path /var/log/fluentd-buffers/kubernetes.containers.buffer
+  # Set queue_full action to block because we want to pause gracefully
+  # in case of the off-the-limits load instead of throwing an exception
+  buffer_queue_full_action block
  # Set the chunk limit conservatively to avoid exceeding the GCL limit
  # of 10MiB per write request.
  buffer_chunk_limit 2M
  # Cap the combined memory usage of this buffer and the one below to
-  # 2MiB/chunk * (24 + 8) chunks = 64 MiB
-  buffer_queue_limit 24
+  # 2MiB/chunk * (6 + 2) chunks = 16 MiB
+  buffer_queue_limit 6
  # Never wait more than 5 seconds before flushing logs in the non-error case.
  flush_interval 5s
  # Never wait longer than 30 seconds between retries.
@ -235,7 +254,7 @@
  # Disable the limit on the number of retries (retry forever).
  disable_retry_limit
  # Use multiple threads for processing.
-  num_threads 8
+  num_threads 2
 </match>

 # Keep a smaller buffer here since these logs are less important than the user's
@ -243,10 +262,13 @@
 <match **>
  type google_cloud
  detect_subservice false
+  buffer_type file
+  buffer_path /var/log/fluentd-buffers/kubernetes.system.buffer
+  buffer_queue_full_action block
  buffer_chunk_limit 2M
-  buffer_queue_limit 8
+  buffer_queue_limit 2
  flush_interval 5s
  max_retry_wait 30
  disable_retry_limit
-  num_threads 8
+  num_threads 2
 </match>
--- a/vendor/k8s.io/kubernetes/cluster/addons/fluentd-gcp/fluentd-gcp-image/google-fluentd.conf
+++ b/vendor/k8s.io/kubernetes/cluster/addons/fluentd-gcp/fluentd-gcp-image/google-fluentd.conf
@ -94,7 +94,6 @@
 <source>
  type tail
  format /^time="(?<time>[^)]*)" level=(?<severity>[^ ]*) msg="(?<message>[^"]*)"( err="(?<error>[^"]*)")?( statusCode=($<status_code>\d+))?/
-  time_format %Y-%m-%dT%H:%M:%S.%NZ
  path /var/log/docker.log
  pos_file /var/log/gcp-docker.log.pos
  tag docker
@ -172,6 +171,20 @@
  tag kube-scheduler
 </source>

+# Example:
+# I1104 10:36:20.242766       5 rescheduler.go:73] Running Rescheduler
+<source>
+  type tail
+  format multiline
+  multiline_flush_interval 5s
+  format_firstline /^\w\d{4}/
+  format1 /^(?<severity>\w)(?<time>\d{4} [^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\] (?<message>.*)/
+  time_format %m%d %H:%M:%S.%N
+  path /var/log/rescheduler.log
+  pos_file /var/log/gcp-rescheduler.log.pos
+  tag rescheduler
+</source>
+
 # Example:
 # I0603 15:31:05.793605       6 cluster_manager.go:230] Reading config from path /etc/gce.conf
 <source>
@ -206,12 +219,18 @@
 # them separate since most users don't care about the node logs.
 <match kubernetes.**>
  type google_cloud
+  # Set the buffer type to file to improve the reliability and reduce the memory consumption
+  buffer_type file
+  buffer_path /var/log/fluentd-buffers/kubernetes.containers.buffer
+  # Set queue_full action to block because we want to pause gracefully
+  # in case of the off-the-limits load instead of throwing an exception
+  buffer_queue_full_action block
  # Set the chunk limit conservatively to avoid exceeding the GCL limit
  # of 10MiB per write request.
  buffer_chunk_limit 2M
  # Cap the combined memory usage of this buffer and the one below to
-  # 2MiB/chunk * (24 + 8) chunks = 64 MiB
-  buffer_queue_limit 24
+  # 2MiB/chunk * (6 + 2) chunks = 16 MiB
+  buffer_queue_limit 6
  # Never wait more than 5 seconds before flushing logs in the non-error case.
  flush_interval 5s
  # Never wait longer than 30 seconds between retries.
@ -219,7 +238,7 @@
  # Disable the limit on the number of retries (retry forever).
  disable_retry_limit
  # Use multiple threads for processing.
-  num_threads 8
+  num_threads 2
 </match>

 # Keep a smaller buffer here since these logs are less important than the user's
@ -227,10 +246,13 @@
 <match **>
  type google_cloud
  detect_subservice false
+  buffer_type file
+  buffer_path /var/log/fluentd-buffers/kubernetes.system.buffer
+  buffer_queue_full_action block
  buffer_chunk_limit 2M
-  buffer_queue_limit 8
+  buffer_queue_limit 2
  flush_interval 5s
  max_retry_wait 30
  disable_retry_limit
-  num_threads 8
+  num_threads 2
 </match>
--- a/vendor/k8s.io/kubernetes/cluster/addons/gci/README.md
+++ b/vendor/k8s.io/kubernetes/cluster/addons/gci/README.md
@ -1,7 +0,0 @@
-Some addons need to be configured slightly differently when running on the
-Google ContainerVM Image (GCI). This directory serves as a place to store yaml
-manifests that need to differ slightly from the ones under
-`cluster/saltbase/salt`.
-
-
-[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/cluster/addons/gci/README.md?pixel)]()
--- a/vendor/k8s.io/kubernetes/cluster/addons/registry/registry-rc.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/addons/registry/registry-rc.yaml
@ -21,7 +21,7 @@ spec:
    spec:
      containers:
      - name: registry
-        image: registry:2
+        image: registry:2.5.1
        resources:
          # keep request = limit to keep this container in guaranteed class
          limits:
--- a/vendor/k8s.io/kubernetes/cluster/aws/config-default.sh
+++ b/vendor/k8s.io/kubernetes/cluster/aws/config-default.sh
@ -120,7 +120,9 @@ fi
 ENABLE_CLUSTER_DNS="${KUBE_ENABLE_CLUSTER_DNS:-true}"
 DNS_SERVER_IP="${DNS_SERVER_IP:-10.0.0.10}"
 DNS_DOMAIN="cluster.local"
-DNS_REPLICAS=1
+
+# Optional: Enable DNS horizontal autoscaler
+ENABLE_DNS_HORIZONTAL_AUTOSCALER="${KUBE_ENABLE_DNS_HORIZONTAL_AUTOSCALER:-false}"

 # Optional: Install Kubernetes UI
 ENABLE_CLUSTER_UI="${KUBE_ENABLE_CLUSTER_UI:-true}"
--- a/vendor/k8s.io/kubernetes/cluster/aws/config-test.sh
+++ b/vendor/k8s.io/kubernetes/cluster/aws/config-test.sh
@ -106,7 +106,9 @@ fi
 ENABLE_CLUSTER_DNS="${KUBE_ENABLE_CLUSTER_DNS:-true}"
 DNS_SERVER_IP="${DNS_SERVER_IP:-10.0.0.10}"
 DNS_DOMAIN="cluster.local"
-DNS_REPLICAS=1
+
+# Optional: Enable DNS horizontal autoscaler
+ENABLE_DNS_HORIZONTAL_AUTOSCALER="${KUBE_ENABLE_DNS_HORIZONTAL_AUTOSCALER:-false}"

 # Optional: Install Kubernetes UI
 ENABLE_CLUSTER_UI="${KUBE_ENABLE_CLUSTER_UI:-true}"
--- a/vendor/k8s.io/kubernetes/cluster/aws/templates/configure-vm-aws.sh
+++ b/vendor/k8s.io/kubernetes/cluster/aws/templates/configure-vm-aws.sh
@ -91,7 +91,6 @@ EOF
  if [[ ! -z "${KUBELET_APISERVER:-}" ]] && [[ ! -z "${KUBELET_CERT:-}" ]] && [[ ! -z "${KUBELET_KEY:-}" ]]; then
    cat <<EOF >>/etc/salt/minion.d/grains.conf
  kubelet_api_servers: '${KUBELET_APISERVER}'
-  cbr-cidr: 10.123.45.0/29
 EOF
  else
    # If the kubelet is running disconnected from a master, give it a fixed
@ -110,7 +109,6 @@ salt-node-role() {
 grains:
  roles:
    - kubernetes-pool
-  cbr-cidr: 10.123.45.0/29
  cloud: aws
  api_servers: '${API_SERVERS}'
 EOF
--- a/vendor/k8s.io/kubernetes/cluster/common.sh
+++ b/vendor/k8s.io/kubernetes/cluster/common.sh
@ -605,9 +605,9 @@ ENABLE_CLUSTER_DNS: $(yaml-quote ${ENABLE_CLUSTER_DNS:-false})
 ENABLE_CLUSTER_REGISTRY: $(yaml-quote ${ENABLE_CLUSTER_REGISTRY:-false})
 CLUSTER_REGISTRY_DISK: $(yaml-quote ${CLUSTER_REGISTRY_DISK:-})
 CLUSTER_REGISTRY_DISK_SIZE: $(yaml-quote ${CLUSTER_REGISTRY_DISK_SIZE:-})
-DNS_REPLICAS: $(yaml-quote ${DNS_REPLICAS:-})
 DNS_SERVER_IP: $(yaml-quote ${DNS_SERVER_IP:-})
 DNS_DOMAIN: $(yaml-quote ${DNS_DOMAIN:-})
+ENABLE_DNS_HORIZONTAL_AUTOSCALER: $(yaml-quote ${ENABLE_DNS_HORIZONTAL_AUTOSCALER:-false})
 KUBELET_TOKEN: $(yaml-quote ${KUBELET_TOKEN:-})
 KUBE_PROXY_TOKEN: $(yaml-quote ${KUBE_PROXY_TOKEN:-})
 ADMISSION_CONTROL: $(yaml-quote ${ADMISSION_CONTROL:-})
@ -699,8 +699,13 @@ ENABLE_MANIFEST_URL: $(yaml-quote ${ENABLE_MANIFEST_URL:-false})
 MANIFEST_URL: $(yaml-quote ${MANIFEST_URL:-})
 MANIFEST_URL_HEADER: $(yaml-quote ${MANIFEST_URL_HEADER:-})
 NUM_NODES: $(yaml-quote ${NUM_NODES})
-STORAGE_BACKEND: $(yaml-quote ${STORAGE_BACKEND:-})
+STORAGE_BACKEND: $(yaml-quote ${STORAGE_BACKEND:-etcd2})
 ENABLE_GARBAGE_COLLECTOR: $(yaml-quote ${ENABLE_GARBAGE_COLLECTOR:-})
+MASTER_ADVERTISE_ADDRESS: $(yaml-quote ${MASTER_ADVERTISE_ADDRESS:-})
+ETCD_CA_KEY: $(yaml-quote ${ETCD_CA_KEY_BASE64:-})
+ETCD_CA_CERT: $(yaml-quote ${ETCD_CA_CERT_BASE64:-})
+ETCD_PEER_KEY: $(yaml-quote ${ETCD_PEER_KEY_BASE64:-})
+ETCD_PEER_CERT: $(yaml-quote ${ETCD_PEER_CERT_BASE64:-})
 EOF
    # ETCD_IMAGE (if set) allows to use a custom etcd image.
    if [ -n "${ETCD_IMAGE:-}" ]; then
--- a/vendor/k8s.io/kubernetes/cluster/gce/config-default.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/config-default.sh
@ -38,13 +38,13 @@ KUBE_DELETE_NODES=${KUBE_DELETE_NODES:-true}
 KUBE_DELETE_NETWORK=${KUBE_DELETE_NETWORK:-false}

 MASTER_OS_DISTRIBUTION=${KUBE_MASTER_OS_DISTRIBUTION:-${KUBE_OS_DISTRIBUTION:-gci}}
-NODE_OS_DISTRIBUTION=${KUBE_NODE_OS_DISTRIBUTION:-${KUBE_OS_DISTRIBUTION:-gci}}
+NODE_OS_DISTRIBUTION=${KUBE_NODE_OS_DISTRIBUTION:-${KUBE_OS_DISTRIBUTION:-debian}}
 # By default a cluster will be started with the master on GCI and nodes on
 # containervm. If you are updating the containervm version, update this
 # variable. Also please update corresponding image for node e2e at:
 # https://github.com/kubernetes/kubernetes/blob/master/test/e2e_node/jenkins/image-config.yaml
 CVM_VERSION=container-vm-v20161025
-GCI_VERSION="gci-dev-56-8938-0-0"
+GCI_VERSION="gci-dev-56-8977-0-0"
 MASTER_IMAGE=${KUBE_GCE_MASTER_IMAGE:-}
 MASTER_IMAGE_PROJECT=${KUBE_GCE_MASTER_PROJECT:-google-containers}
 NODE_IMAGE=${KUBE_GCE_NODE_IMAGE:-${CVM_VERSION}}
@ -113,7 +113,9 @@ FEATURE_GATES="${KUBE_FEATURE_GATES:-}"
 ENABLE_CLUSTER_DNS="${KUBE_ENABLE_CLUSTER_DNS:-true}"
 DNS_SERVER_IP="${KUBE_DNS_SERVER_IP:-10.0.0.10}"
 DNS_DOMAIN="${KUBE_DNS_DOMAIN:-cluster.local}"
-DNS_REPLICAS=1
+
+# Optional: Enable DNS horizontal autoscaler
+ENABLE_DNS_HORIZONTAL_AUTOSCALER="${KUBE_ENABLE_DNS_HORIZONTAL_AUTOSCALER:-true}"

 # Optional: Install cluster docker registry.
 ENABLE_CLUSTER_REGISTRY="${KUBE_ENABLE_CLUSTER_REGISTRY:-false}"
--- a/vendor/k8s.io/kubernetes/cluster/gce/config-test.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/config-test.sh
@ -39,13 +39,13 @@ KUBE_DELETE_NODES=${KUBE_DELETE_NODES:-true}
 KUBE_DELETE_NETWORK=${KUBE_DELETE_NETWORK:-true}

 MASTER_OS_DISTRIBUTION=${KUBE_MASTER_OS_DISTRIBUTION:-${KUBE_OS_DISTRIBUTION:-gci}}
-NODE_OS_DISTRIBUTION=${KUBE_NODE_OS_DISTRIBUTION:-${KUBE_OS_DISTRIBUTION:-gci}}
+NODE_OS_DISTRIBUTION=${KUBE_NODE_OS_DISTRIBUTION:-${KUBE_OS_DISTRIBUTION:-debian}}
 # By default a cluster will be started with the master on GCI and nodes on
 # containervm. If you are updating the containervm version, update this
 # variable. Also please update corresponding image for node e2e at:
 # https://github.com/kubernetes/kubernetes/blob/master/test/e2e_node/jenkins/image-config.yaml
 CVM_VERSION=container-vm-v20161025
-GCI_VERSION="gci-dev-56-8938-0-0"
+GCI_VERSION="gci-dev-56-8977-0-0"
 MASTER_IMAGE=${KUBE_GCE_MASTER_IMAGE:-}
 MASTER_IMAGE_PROJECT=${KUBE_GCE_MASTER_PROJECT:-google-containers}
 NODE_IMAGE=${KUBE_GCE_NODE_IMAGE:-${CVM_VERSION}}
@ -94,7 +94,7 @@ ENABLE_L7_LOADBALANCING="${KUBE_ENABLE_L7_LOADBALANCING:-glbc}"
 #   standalone     - Heapster only. Metrics available via Heapster REST API.
 ENABLE_CLUSTER_MONITORING="${KUBE_ENABLE_CLUSTER_MONITORING:-influxdb}"

-# Set etcd image (e.g. 3.0.13-experimental.1) version (e.g. 3.0.13) if you need
+# Set etcd image (e.g. 3.0.14-experimental.1) version (e.g. 3.0.14) if you need
 # non-default version.
 ETCD_IMAGE="${TEST_ETCD_IMAGE:-}"
 ETCD_VERSION="${TEST_ETCD_VERSION:-}"
@ -140,7 +140,9 @@ fi
 ENABLE_CLUSTER_DNS="${KUBE_ENABLE_CLUSTER_DNS:-true}"
 DNS_SERVER_IP="10.0.0.10"
 DNS_DOMAIN="cluster.local"
-DNS_REPLICAS=1
+
+# Optional: Enable DNS horizontal autoscaler
+ENABLE_DNS_HORIZONTAL_AUTOSCALER="${KUBE_ENABLE_DNS_HORIZONTAL_AUTOSCALER:-true}"

 # Optional: Install cluster docker registry.
 ENABLE_CLUSTER_REGISTRY="${KUBE_ENABLE_CLUSTER_REGISTRY:-false}"
--- a/vendor/k8s.io/kubernetes/cluster/gce/configure-vm.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/configure-vm.sh
@ -439,9 +439,9 @@ logging_destination: '$(echo "$LOGGING_DESTINATION" | sed -e "s/'/''/g")'
 elasticsearch_replicas: '$(echo "$ELASTICSEARCH_LOGGING_REPLICAS" | sed -e "s/'/''/g")'
 enable_cluster_dns: '$(echo "$ENABLE_CLUSTER_DNS" | sed -e "s/'/''/g")'
 enable_cluster_registry: '$(echo "$ENABLE_CLUSTER_REGISTRY" | sed -e "s/'/''/g")'
-dns_replicas: '$(echo "$DNS_REPLICAS" | sed -e "s/'/''/g")'
 dns_server: '$(echo "$DNS_SERVER_IP" | sed -e "s/'/''/g")'
 dns_domain: '$(echo "$DNS_DOMAIN" | sed -e "s/'/''/g")'
+enable_dns_horizontal_autoscaler: '$(echo "$ENABLE_DNS_HORIZONTAL_AUTOSCALER" | sed -e "s/'/''/g")'
 admission_control: '$(echo "$ADMISSION_CONTROL" | sed -e "s/'/''/g")'
 network_provider: '$(echo "$NETWORK_PROVIDER" | sed -e "s/'/''/g")'
 prepull_e2e_images: '$(echo "$PREPULL_E2E_IMAGES" | sed -e "s/'/''/g")'
@ -457,6 +457,7 @@ num_nodes: $(echo "${NUM_NODES:-}" | sed -e "s/'/''/g")
 e2e_storage_test_environment: '$(echo "$E2E_STORAGE_TEST_ENVIRONMENT" | sed -e "s/'/''/g")'
 kube_uid: '$(echo "${KUBE_UID}" | sed -e "s/'/''/g")'
 initial_etcd_cluster: '$(echo "${INITIAL_ETCD_CLUSTER:-}" | sed -e "s/'/''/g")'
+
 hostname: $(hostname -s)
 EOF
    if [ -n "${STORAGE_BACKEND:-}" ]; then
@ -482,6 +483,15 @@ EOF
    if [ -n "${ETCD_VERSION:-}" ]; then
      cat <<EOF >>/srv/salt-overlay/pillar/cluster-params.sls
 etcd_version: '$(echo "$ETCD_VERSION" | sed -e "s/'/''/g")'
+EOF
+    fi
+    if [[ -n "${ETCD_CA_KEY:-}" && -n "${ETCD_CA_CERT:-}" && -n "${ETCD_PEER_KEY:-}" && -n "${ETCD_PEER_CERT:-}" ]]; then
+      cat <<EOF >>/srv/salt-overlay/pillar/cluster-params.sls
+etcd_over_ssl: 'true'
+EOF
+    else
+      cat <<EOF >>/srv/salt-overlay/pillar/cluster-params.sls
+etcd_over_ssl: 'false'
 EOF
    fi
    # Configuration changes for test clusters
@ -958,7 +968,6 @@ EOF
  if [[ ! -z "${KUBELET_APISERVER:-}" ]] && [[ ! -z "${KUBELET_CERT:-}" ]] && [[ ! -z "${KUBELET_KEY:-}" ]]; then
    cat <<EOF >>/etc/salt/minion.d/grains.conf
  kubelet_api_servers: '${KUBELET_APISERVER}'
-  cbr-cidr: 10.123.45.0/29
 EOF
  else
    # If the kubelet is running disconnected from a master, give it a fixed
@ -977,7 +986,6 @@ function salt-node-role() {
 grains:
  roles:
    - kubernetes-pool
-  cbr-cidr: 10.123.45.0/29
  cloud: gce
  api_servers: '${KUBERNETES_MASTER_NAME}'
 EOF
@ -1056,6 +1064,15 @@ function run-user-script() {
  fi
 }

+function create-salt-master-etcd-auth {
+  if [[ -n "${ETCD_CA_CERT:-}" && -n "${ETCD_PEER_KEY:-}" && -n "${ETCD_PEER_CERT:-}" ]]; then
+    local -r auth_dir="/srv/kubernetes"
+    echo "${ETCD_CA_CERT}" | base64 --decode | gunzip > "${auth_dir}/etcd-ca.crt"
+    echo "${ETCD_PEER_KEY}" | base64 --decode > "${auth_dir}/etcd-peer.key"
+    echo "${ETCD_PEER_CERT}" | base64 --decode | gunzip > "${auth_dir}/etcd-peer.crt"
+  fi
+}
+
 # This script is re-used on AWS.  Some of the above functions will be replaced.
 # The AWS kube-up script looks for this marker:
 #+AWS_OVERRIDES_HERE
@ -1076,6 +1093,7 @@ if [[ -z "${is_push}" ]]; then
  create-salt-pillar
  if [[ "${KUBERNETES_MASTER}" == "true" ]]; then
    create-salt-master-auth
+    create-salt-master-etcd-auth
    create-salt-master-kubelet-auth
  else
    create-salt-kubelet-auth
--- a/vendor/k8s.io/kubernetes/cluster/gce/coreos/configure-node.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/coreos/configure-node.sh
@ -135,6 +135,9 @@ function configure-master-addons() {

  if [[ "${ENABLE_CLUSTER_DNS}" == "true" ]]; then
    evaluate-manifests-dir ${MANIFESTS_DIR}/addons/dns ${addon_dir}/dns
+    if [[ "${ENABLE_DNS_HORIZONTAL_AUTOSCALER}" == "true" ]]; then
+      evaluate-manifests-dir ${MANIFESTS_DIR}/addons/dns-horizontal-autoscaler ${addon_dir}/dns-horizontal-autoscaler
+    fi
  fi

  if [[ "${ENABLE_CLUSTER_UI}" == "true" ]]; then
--- a/vendor/k8s.io/kubernetes/cluster/gce/coreos/kube-manifests/addons/dashboard/dashboard-controller.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/gce/coreos/kube-manifests/addons/dashboard/dashboard-controller.yaml
@ -1,23 +1,23 @@
-apiVersion: v1
-kind: ReplicationController
+# Keep this file in sync with addons/dashboard/dashboard-controller.yaml
+apiVersion: extensions/v1beta1
+kind: Deployment
 metadata:
-  # Keep this file in sync with addons/dashboard/dashboard-controller.yaml
-  name: kubernetes-dashboard-v1.4.0
+  name: kubernetes-dashboard
  namespace: kube-system
  labels:
    k8s-app: kubernetes-dashboard
-    version: v1.4.0
    kubernetes.io/cluster-service: "true"
 spec:
-  replicas: 1
  selector:
-    k8s-app: kubernetes-dashboard
+    matchLabels:
+      k8s-app: kubernetes-dashboard
  template:
    metadata:
      labels:
        k8s-app: kubernetes-dashboard
-        version: v1.4.0
-        kubernetes.io/cluster-service: "true"
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ''
+        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
    spec:
      containers:
      - name: kubernetes-dashboard
--- a/vendor/k8s.io/kubernetes/cluster/gce/coreos/kube-manifests/addons/dns/skydns-rc.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/gce/coreos/kube-manifests/addons/dns/skydns-rc.yaml
@ -1,22 +1,23 @@
-apiVersion: v1
-kind: ReplicationController
+apiVersion: extensions/v1beta1
+kind: Deployment
 metadata:
-  name: kube-dns-v20
+  name: kube-dns
  namespace: kube-system
  labels:
    k8s-app: kube-dns
-    version: v20
    kubernetes.io/cluster-service: "true"
 spec:
-  replicas: ${DNS_REPLICAS}
+  # replicas: not specified here:
+  # 1. In order to make Addon Manager do not reconcile this replicas parameter.
+  # 2. Default is 1.
+  # 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
  selector:
-    k8s-app: kube-dns
-    version: v20
+    matchLabels:
+      k8s-app: kube-dns
  template:
    metadata:
      labels:
        k8s-app: kube-dns
-        version: v20
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
@ -56,6 +57,10 @@ spec:
        # command = "/kube-dns"
        - --domain=${DNS_DOMAIN}.
        - --dns-port=10053
+        - --v=0
+        env:
+          - name: PROMETHEUS_PORT
+            value: "10055"
        ports:
        - containerPort: 10053
          name: dns-local
@ -63,6 +68,9 @@ spec:
        - containerPort: 10053
          name: dns-tcp-local
          protocol: TCP
+        - containerPort: 10055
+          name: metrics
+          protocol: TCP
      - name: dnsmasq
        image: gcr.io/google_containers/kube-dnsmasq-amd64:1.4
        livenessProbe:
@ -86,6 +94,27 @@ spec:
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
+      - name: dnsmasq-metrics
+        image: gcr.io/google_containers/dnsmasq-metrics-amd64:1.0
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 10054
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        args:
+        - --v=2
+        - --logtostderr
+        ports:
+        - containerPort: 10054
+          name: metrics
+          protocol: TCP
+        resources:
+          requests:
+            memory: 10Mi
      - name: healthz
        image: gcr.io/google_containers/exechealthz-amd64:1.2
        resources:
--- a/vendor/k8s.io/kubernetes/cluster/gce/debian/master-helper.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/debian/master-helper.sh
@ -52,6 +52,17 @@ function replicate-master-instance() {
  # Substitute INITIAL_ETCD_CLUSTER to enable etcd clustering.
  kube_env="$(echo "${kube_env}" | grep -v "INITIAL_ETCD_CLUSTER")"
  kube_env="$(echo -e "${kube_env}\nINITIAL_ETCD_CLUSTER: '${existing_master_replicas},${REPLICA_NAME}'")"
+
+  ETCD_CA_KEY="$(echo "${kube_env}" | grep "ETCD_CA_KEY" |  sed "s/^.*: '//" | sed "s/'$//")"
+  ETCD_CA_CERT="$(echo "${kube_env}" | grep "ETCD_CA_CERT" |  sed "s/^.*: '//" | sed "s/'$//")"
+
+  create-etcd-certs "${ETCD_CA_CERT}" "${ETCD_CA_KEY}"
+
+  kube_env="$(echo "${kube_env}" | grep -v "ETCD_PEER_KEY")"
+  kube_env="$(echo -e "${kube_env}\nETCD_PEER_KEY: '${ETCD_PEER_KEY_BASE64}'")"
+  kube_env="$(echo "${kube_env}" | grep -v "ETCD_PEER_CERT")"
+  kube_env="$(echo -e "${kube_env}\nETCD_PEER_CERT: '${ETCD_PEER_CERT_BASE64}'")"
+
  echo "${kube_env}" > ${KUBE_TEMP}/master-kube-env.yaml
  get-metadata "${existing_master_zone}" "${existing_master_name}" cluster-name > ${KUBE_TEMP}/cluster-name.txt
  get-metadata "${existing_master_zone}" "${existing_master_name}" startup-script > ${KUBE_TEMP}/configure-vm.sh
--- a/vendor/k8s.io/kubernetes/cluster/gce/gci/configure-helper.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/gci/configure-helper.sh
@ -375,6 +375,15 @@ current-context: service-account-context
 EOF
 }

+function create-master-etcd-auth {
+  if [[ -n "${ETCD_CA_CERT:-}" && -n "${ETCD_PEER_KEY:-}" && -n "${ETCD_PEER_CERT:-}" ]]; then
+    local -r auth_dir="/etc/srv/kubernetes"
+    echo "${ETCD_CA_CERT}" | base64 --decode | gunzip > "${auth_dir}/etcd-ca.crt"
+    echo "${ETCD_PEER_KEY}" | base64 --decode > "${auth_dir}/etcd-peer.key"
+    echo "${ETCD_PEER_CERT}" | base64 --decode | gunzip > "${auth_dir}/etcd-peer.crt"
+  fi
+}
+
 function assemble-docker-flags {
  echo "Assemble docker command line flags"
  local docker_opts="-p /var/run/docker.pid --iptables=false --ip-masq=false"
@ -473,6 +482,8 @@ function start-kubelet {
  flags+=" --cluster-dns=${DNS_SERVER_IP}"
  flags+=" --cluster-domain=${DNS_DOMAIN}"
  flags+=" --config=/etc/kubernetes/manifests"
+  flags+=" --experimental-mounter-path=${KUBE_HOME}/bin/mounter"
+  flags+=" --experimental-check-node-capabilities-before-mount=true"

  if [[ -n "${KUBELET_PORT:-}" ]]; then
    flags+=" --port=${KUBELET_PORT}"
@ -483,11 +494,8 @@ function start-kubelet {
    if [[ ! -z "${KUBELET_APISERVER:-}" && ! -z "${KUBELET_CERT:-}" && ! -z "${KUBELET_KEY:-}" ]]; then
      flags+=" --api-servers=https://${KUBELET_APISERVER}"
      flags+=" --register-schedulable=false"
-      # need at least a /29 pod cidr for now due to #32844
-      # TODO: determine if we still allow non-hostnetwork pods to run on master, clean up master pod setup
-      # WARNING: potential ip range collision with 10.123.45.0/29
-      flags+=" --pod-cidr=10.123.45.0/29"
    else
+      # Standalone mode (not widely used?)
      flags+=" --pod-cidr=${MASTER_IP_RANGE}"
    fi
  else # For nodes
@ -607,14 +615,23 @@ function prepare-etcd-manifest {
  local host_name=$(hostname)
  local etcd_cluster=""
  local cluster_state="new"
+  local etcd_protocol="http"
+  local etcd_creds=""
+
+  if [[ -n "${ETCD_CA_KEY:-}" && -n "${ETCD_CA_CERT:-}" && -n "${ETCD_PEER_KEY:-}" && -n "${ETCD_PEER_CERT:-}" ]]; then
+    etcd_creds=" --peer-trusted-ca-file /etc/srv/kubernetes/etcd-ca.crt --peer-cert-file /etc/srv/kubernetes/etcd-peer.crt --peer-key-file /etc/srv/kubernetes/etcd-peer.key -peer-client-cert-auth "
+    etcd_protocol="https"
+  fi
+
  for host in $(echo "${INITIAL_ETCD_CLUSTER:-${host_name}}" | tr "," "\n"); do
-    etcd_host="etcd-${host}=http://${host}:$3"
+    etcd_host="etcd-${host}=${etcd_protocol}://${host}:$3"
    if [[ -n "${etcd_cluster}" ]]; then
      etcd_cluster+=","
      cluster_state="existing"
    fi
    etcd_cluster+="${etcd_host}"
  done
+
  local -r temp_file="/tmp/$5"
  cp "${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/etcd.manifest" "${temp_file}"
  remove-salt-config-comments "${temp_file}"
@ -623,14 +640,22 @@ function prepare-etcd-manifest {
  sed -i -e "s@{{ *server_port *}}@$3@g" "${temp_file}"
  sed -i -e "s@{{ *cpulimit *}}@\"$4\"@g" "${temp_file}"
  sed -i -e "s@{{ *hostname *}}@$host_name@g" "${temp_file}"
+  sed -i -e "s@{{ *srv_kube_path *}}@/etc/srv/kubernetes@g" "${temp_file}"
  sed -i -e "s@{{ *etcd_cluster *}}@$etcd_cluster@g" "${temp_file}"
  sed -i -e "s@{{ *storage_backend *}}@${STORAGE_BACKEND:-}@g" "${temp_file}"
+  if [[ "${STORAGE_BACKEND:-}" == "etcd3" ]]; then
+    sed -i -e "s@{{ *quota_bytes *}}@--quota-backend-bytes=4294967296@g" "${temp_file}"
+  else
+    sed -i -e "s@{{ *quota_bytes *}}@@g" "${temp_file}"
+  fi
  sed -i -e "s@{{ *cluster_state *}}@$cluster_state@g" "${temp_file}"
  if [[ -n "${ETCD_IMAGE:-}" ]]; then
    sed -i -e "s@{{ *pillar\.get('etcd_docker_tag', '\(.*\)') *}}@${ETCD_IMAGE}@g" "${temp_file}"
  else
    sed -i -e "s@{{ *pillar\.get('etcd_docker_tag', '\(.*\)') *}}@\1@g" "${temp_file}"
  fi
+  sed -i -e "s@{{ *etcd_protocol *}}@$etcd_protocol@g" "${temp_file}"
+  sed -i -e "s@{{ *etcd_creds *}}@$etcd_creds@g" "${temp_file}"
  if [[ -n "${ETCD_VERSION:-}" ]]; then
    sed -i -e "s@{{ *pillar\.get('etcd_version', '\(.*\)') *}}@${ETCD_VERSION}@g" "${temp_file}"
  else
@ -735,6 +760,10 @@ function start-kube-apiserver {
    params+=" --enable-garbage-collector=${ENABLE_GARBAGE_COLLECTOR}"
  fi
  if [[ -n "${NUM_NODES:-}" ]]; then
+    # If the cluster is large, increase max-requests-inflight limit in apiserver.
+    if [[ "${NUM_NODES}" -ge 1000 ]]; then
+      params+=" --max-requests-inflight=1500"
+    fi
    # Set amount of memory available for apiserver based on number of nodes.
    # TODO: Once we start setting proper requests and limits for apiserver
    # we should reuse the same logic here instead of current heuristic.
@ -775,6 +804,8 @@ function start-kube-apiserver {
    params+=" --advertise-address=${vm_external_ip}"
    params+=" --ssh-user=${PROXY_SSH_USER}"
    params+=" --ssh-keyfile=/etc/srv/sshproxy/.sshkeyfile"
+  else [ -n "${MASTER_ADVERTISE_ADDRESS:-}" ]
+    params="${params} --advertise-address=${MASTER_ADVERTISE_ADDRESS}"
  fi

  local webhook_authn_config_mount=""
@ -982,11 +1013,8 @@ function start-kube-addons {
    setup-addon-manifests "addons" "${file_dir}"
    # Replace the salt configurations with variable values.
    base_metrics_memory="140Mi"
-    metrics_memory="${base_metrics_memory}"
    base_eventer_memory="190Mi"
    base_metrics_cpu="80m"
-    metrics_cpu="${base_metrics_cpu}"
-    eventer_memory="${base_eventer_memory}"
    nanny_memory="90Mi"
    local -r metrics_memory_per_node="4"
    local -r metrics_cpu_per_node="0.5"
@ -994,10 +1022,7 @@ function start-kube-addons {
    local -r nanny_memory_per_node="200"
    if [[ -n "${NUM_NODES:-}" && "${NUM_NODES}" -ge 1 ]]; then
      num_kube_nodes="$((${NUM_NODES}+1))"
-      metrics_memory="$((${num_kube_nodes} * ${metrics_memory_per_node} + 200))Mi"
-      eventer_memory="$((${num_kube_nodes} * ${eventer_memory_per_node} + 200 * 1024))Ki"
      nanny_memory="$((${num_kube_nodes} * ${nanny_memory_per_node} + 90 * 1024))Ki"
-      metrics_cpu=$(echo - | awk "{print ${num_kube_nodes} * ${metrics_cpu_per_node} + 80}")m
    fi
    controller_yaml="${dst_dir}/${file_dir}"
    if [[ "${ENABLE_CLUSTER_MONITORING:-}" == "googleinfluxdb" ]]; then
@ -1007,11 +1032,8 @@ function start-kube-addons {
    fi
    remove-salt-config-comments "${controller_yaml}"
    sed -i -e "s@{{ *base_metrics_memory *}}@${base_metrics_memory}@g" "${controller_yaml}"
-    sed -i -e "s@{{ *metrics_memory *}}@${metrics_memory}@g" "${controller_yaml}"
    sed -i -e "s@{{ *base_metrics_cpu *}}@${base_metrics_cpu}@g" "${controller_yaml}"
-    sed -i -e "s@{{ *metrics_cpu *}}@${metrics_cpu}@g" "${controller_yaml}"
    sed -i -e "s@{{ *base_eventer_memory *}}@${base_eventer_memory}@g" "${controller_yaml}"
-    sed -i -e "s@{{ *eventer_memory *}}@${eventer_memory}@g" "${controller_yaml}"
    sed -i -e "s@{{ *metrics_memory_per_node *}}@${metrics_memory_per_node}@g" "${controller_yaml}"
    sed -i -e "s@{{ *eventer_memory_per_node *}}@${eventer_memory_per_node}@g" "${controller_yaml}"
    sed -i -e "s@{{ *nanny_memory *}}@${nanny_memory}@g" "${controller_yaml}"
@ -1024,10 +1046,13 @@ function start-kube-addons {
    mv "${dst_dir}/dns/skydns-rc.yaml.in" "${dns_rc_file}"
    mv "${dst_dir}/dns/skydns-svc.yaml.in" "${dns_svc_file}"
    # Replace the salt configurations with variable values.
-    sed -i -e "s@{{ *pillar\['dns_replicas'\] *}}@${DNS_REPLICAS}@g" "${dns_rc_file}"
    sed -i -e "s@{{ *pillar\['dns_domain'\] *}}@${DNS_DOMAIN}@g" "${dns_rc_file}"
    sed -i -e "s@{{ *pillar\['dns_server'\] *}}@${DNS_SERVER_IP}@g" "${dns_svc_file}"

+    if [[ "${ENABLE_DNS_HORIZONTAL_AUTOSCALER:-}" == "true" ]]; then
+      setup-addon-manifests "addons" "dns-horizontal-autoscaler"
+    fi
+
    if [[ "${FEDERATION:-}" == "true" ]]; then
      local federations_domain_map="${FEDERATIONS_DOMAIN_MAP:-}"
      if [[ -z "${federations_domain_map}" && -n "${FEDERATION_NAME:-}" && -n "${DNS_ZONE_NAME:-}" ]]; then
@ -1081,7 +1106,7 @@ function start-fluentd {
  echo "Start fluentd pod"
  if [[ "${ENABLE_NODE_LOGGING:-}" == "true" ]]; then
    if [[ "${LOGGING_DESTINATION:-}" == "gcp" ]]; then
-      cp "${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty/gci/fluentd-gcp.yaml" /etc/kubernetes/manifests/
+      cp "${KUBE_HOME}/kube-manifests/kubernetes/fluentd-gcp-gci.yaml" /etc/kubernetes/manifests/
    elif [[ "${LOGGING_DESTINATION:-}" == "elasticsearch" && "${KUBERNETES_MASTER:-}" != "true" ]]; then
      # Running fluentd-es on the master is pointless, as it can't communicate
      # with elasticsearch from there in the default configuration.
@ -1168,9 +1193,15 @@ EOF
 }

 function override-kubectl {
+    echo "overriding kubectl"
    echo "export PATH=${KUBE_HOME}/bin:\$PATH" > /etc/profile.d/kube_env.sh
 }

+function pre-warm-mounter {
+    echo "prewarming mounter"
+    ${KUBE_HOME}/bin/mounter &> /dev/null
+}
+
 ########### Main Function ###########
 echo "Start to configure instance for kubernetes"

@ -1199,12 +1230,15 @@ if [[ "${KUBERNETES_MASTER:-}" == "true" ]]; then
  mount-master-pd
  create-master-auth
  create-master-kubelet-auth
+  create-master-etcd-auth
 else
  create-kubelet-kubeconfig
  create-kubeproxy-kubeconfig
 fi

 override-kubectl
+# Run the containerized mounter once to pre-cache the container image.
+pre-warm-mounter
 assemble-docker-flags
 load-docker-images
 start-kubelet
--- a/vendor/k8s.io/kubernetes/cluster/gce/gci/configure.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/gci/configure.sh
@ -98,13 +98,20 @@ function split-commas {
  echo $1 | tr "," "\n"
 }

-function install-rkt {
-    local -r rkt_binary="rkt-v1.18.0"
-    local -r rkt_sha1="75fc8f29c79bc9e505f3e7f6e8fadf2425c21967"
-    download-or-bust "${rkt_sha1}" "https://storage.googleapis.com/kubernetes-release/rkt/${rkt_binary}"
-    local -r rkt_dst="${KUBE_HOME}/bin/rkt"
-    mv "${KUBE_HOME}/${rkt_binary}" "${rkt_dst}"
-    chmod a+x "${rkt_dst}"
+function install-gci-mounter-tools {
+    local -r rkt_version="v1.18.0"
+    local -r gci_mounter_version="v2"
+    local -r rkt_binary_sha1="75fc8f29c79bc9e505f3e7f6e8fadf2425c21967"
+    local -r rkt_stage1_fly_sha1="474df5a1f934960ba669b360ab713d0a54283091"
+    local -r gci_mounter_sha1="851e841d8640d6a05e64e22c493f5ac3c4cba561"
+    download-or-bust "${rkt_binary_sha1}" "https://storage.googleapis.com/kubernetes-release/rkt/${rkt_version}/rkt"
+    download-or-bust "${rkt_stage1_fly_sha1}" "https://storage.googleapis.com/kubernetes-release/rkt/${rkt_version}/stage1-fly.aci"
+    download-or-bust "${gci_mounter_sha1}" "https://storage.googleapis.com/kubernetes-release/gci-mounter/gci-mounter-${gci_mounter_version}.aci"
+    local -r rkt_dst="${KUBE_HOME}/bin/"
+    mv "${KUBE_HOME}/rkt" "${rkt_dst}/rkt"
+    mv "${KUBE_HOME}/stage1-fly.aci" "${rkt_dst}/stage1-fly.aci"
+    mv "${KUBE_HOME}/gci-mounter-${gci_mounter_version}.aci" "${rkt_dst}/gci-mounter-${gci_mounter_version}.aci"
+    chmod a+x "${rkt_dst}/rkt"
 }

 # Downloads kubernetes binaries and kube-system manifest tarball, unpacks them,
@ -184,8 +191,8 @@ function install-kube-binary-config {
  cp "${dst_dir}/kubernetes/gci-trusty/health-monitor.sh" "${KUBE_HOME}/bin/health-monitor.sh"
  chmod -R 755 "${kube_bin}"

-  # Install rkt binary to allow mounting storage volumes in GCI
-  install-rkt
+  # Install gci mounter related artifacts to allow mounting storage volumes in GCI
+  install-gci-mounter-tools
  
  # Clean up.
  rm -rf "${KUBE_HOME}/kubernetes"
--- a/vendor/k8s.io/kubernetes/cluster/gce/gci/master-helper.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/gci/master-helper.sh
@ -49,6 +49,16 @@ function replicate-master-instance() {
  # Substitute INITIAL_ETCD_CLUSTER to enable etcd clustering.
  kube_env="$(echo "${kube_env}" | grep -v "INITIAL_ETCD_CLUSTER")"
  kube_env="$(echo -e "${kube_env}\nINITIAL_ETCD_CLUSTER: '${existing_master_replicas},${REPLICA_NAME}'")"
+  ETCD_CA_KEY="$(echo "${kube_env}" | grep "ETCD_CA_KEY" |  sed "s/^.*: '//" | sed "s/'$//")"
+  ETCD_CA_CERT="$(echo "${kube_env}" | grep "ETCD_CA_CERT" |  sed "s/^.*: '//" | sed "s/'$//")"
+
+  create-etcd-certs "${ETCD_CA_CERT}" "${ETCD_CA_KEY}"
+
+  kube_env="$(echo "${kube_env}" | grep -v "ETCD_PEER_KEY")"
+  kube_env="$(echo -e "${kube_env}\nETCD_PEER_KEY: '${ETCD_PEER_KEY_BASE64}'")"
+  kube_env="$(echo "${kube_env}" | grep -v "ETCD_PEER_CERT")"
+  kube_env="$(echo -e "${kube_env}\nETCD_PEER_CERT: '${ETCD_PEER_CERT_BASE64}'")"
+
  echo "${kube_env}" > ${KUBE_TEMP}/master-kube-env.yaml
  get-metadata "${existing_master_zone}" "${existing_master_name}" cluster-name > "${KUBE_TEMP}/cluster-name.txt"
  get-metadata "${existing_master_zone}" "${existing_master_name}" gci-update-strategy > "${KUBE_TEMP}/gci-update.txt"
@ -58,6 +68,7 @@ function replicate-master-instance() {
  create-master-instance-internal "${REPLICA_NAME}"
 }

+
 function create-master-instance-internal() {
  local -r master_name="${1}"
  local -r address_option="${2:-}"
--- a/vendor/k8s.io/kubernetes/cluster/gce/gci/mounter/Makefile
+++ b/vendor/k8s.io/kubernetes/cluster/gce/gci/mounter/Makefile
@ -24,4 +24,7 @@ container:
 push: 
 	gcloud docker -- push ${REGISTRY}/${IMAGE}:${TAG}

+upload:
+	./stage-upload.sh ${TAG} ${REGISTRY}/${IMAGE}:${TAG}
+
 .PHONY: all container push
--- a/vendor/k8s.io/kubernetes/cluster/gce/gci/mounter/mounter
+++ b/vendor/k8s.io/kubernetes/cluster/gce/gci/mounter/mounter
@ -14,23 +14,42 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-set -e
+set -o errexit
+set -o nounset
 set -o pipefail

-MOUNTER_DOCKER_IMAGE=gcr.io/google_containers/gci-mounter
-MOUNTER_DOCKER_VERSION=v2
+MOUNTER_VERSION=v2
 MOUNTER_USER=root
-RKT_BINARY=/home/kubernetes/bin/rkt
+ROOT_DIR=/home/kubernetes/bin
+RKT_BINARY=${ROOT_DIR}/rkt
+STAGE1_ACI=${ROOT_DIR}/stage1-fly.aci
+MOUNTER_ACI=${ROOT_DIR}/gci-mounter-${MOUNTER_VERSION}.aci
+MOUNTER_IMAGE=gcr.io/google_containers/gci-mounter:${MOUNTER_VERSION}

 function gc {
-    ${RKT_BINARY} gc --grace-period=0s &> /dev/null
+    # Attempt to garbage collect rkt pods with 5 retries.
+    # Rkt pods end up creating new copies of mounts on the host. Hence it is ideal to clean them up right away.
+    attempt=0
+    until [ $attempt -ge 5 ]; do
+	${RKT_BINARY} gc --grace-period=0s &> /dev/null && break
+	attempt=$[$attempt+1]
+	sleep 1
+    done
 }

 # Garbage collect old rkt containers on exit
 trap gc EXIT

-${RKT_BINARY} run --stage1-name="coreos.com/rkt/stage1-fly:1.18.0" \
+if [[ ! $(${RKT_BINARY} image list | grep ${MOUNTER_IMAGE}) ]]; then
+        ${RKT_BINARY} fetch --insecure-options=image file://${MOUNTER_ACI}
+fi
+
+echo "Running mount using a rkt fly container"
+
+${RKT_BINARY} run --stage1-path=${STAGE1_ACI} \
 	--insecure-options=image \
-	--volume=rootfs,kind=host,source=/,readOnly=false,recursive=true \
-	--mount volume=rootfs,target=/media/root \
-	docker://${MOUNTER_DOCKER_IMAGE}:${MOUNTER_DOCKER_VERSION} --user=${MOUNTER_USER} --exec /bin/mount -- "$@"
+	--volume=kubelet,kind=host,source=/var/lib/kubelet,readOnly=false,recursive=true \
+	--mount volume=kubelet,target=/var/lib/kubelet \
+	${MOUNTER_IMAGE} --user=${MOUNTER_USER} --exec /bin/mount -- "$@"
+
+echo "Successfully ran mount using a rkt fly container"
--- a/vendor/k8s.io/kubernetes/cluster/gce/gci/mounter/stage-upload.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/gci/mounter/stage-upload.sh
@ -0,0 +1,86 @@
+#!/bin/sh
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Due to the GCE custom metadata size limit, we split the entire script into two
+# files configure.sh and configure-helper.sh. The functionality of downloading
+# kubernetes configuration, manifests, docker images, and binary files are
+# put in configure.sh, which is uploaded via GCE custom metadata.
+
+set -o errexit
+set -o pipefail
+set -o nounset
+
+RKT_VERSION="v1.18.0"
+DOCKER2ACI_VERSION="v0.13.0"
+MOUNTER_VERSION=$1
+DOCKER_IMAGE=docker://$2
+MOUNTER_ACI_IMAGE=gci-mounter-${MOUNTER_VERSION}.aci
+RKT_GCS_DIR=gs://kubernetes-release/rkt/
+MOUNTER_GCS_DIR=gs://kubernetes-release/gci-mounter/
+
+TMPDIR=/tmp
+# Setup a working directory
+DOWNLOAD_DIR=$(mktemp --tmpdir=${TMPDIR} -d gci-mounter-build.XXXXXXXXXX)
+
+# Setup a staging directory
+STAGING_DIR=$(mktemp --tmpdir=${TMPDIR} -d gci-mounter-staging.XXXXXXXXXX)
+RKT_DIR=${STAGING_DIR}/${RKT_VERSION}
+ACI_DIR=${STAGING_DIR}/gci-mounter
+CWD=${PWD}
+
+# Cleanup the temporary directories
+function cleanup {
+    rm -rf ${DOWNLOAD_DIR}
+    rm -rf ${STAGING_DIR}
+    cd ${CWD}
+}
+
+# Delete temporary directories on exit
+trap cleanup EXIT
+
+mkdir ${RKT_DIR}
+mkdir ${ACI_DIR}
+
+# Download rkt
+cd ${DOWNLOAD_DIR}
+echo "Downloading rkt ${RKT_VERSION}"
+wget "https://github.com/coreos/rkt/releases/download/${RKT_VERSION}/rkt-${RKT_VERSION}.tar.gz" &> /dev/null
+echo "Extracting rkt ${RKT_VERSION}"
+tar xzf rkt-${RKT_VERSION}.tar.gz
+
+# Stage rkt into working directory
+cp rkt-${RKT_VERSION}/rkt ${RKT_DIR}/rkt
+cp rkt-${RKT_VERSION}/stage1-fly.aci ${RKT_DIR}/
+
+# Convert docker image to aci and stage it
+echo "Downloading docker2aci ${DOCKER2ACI_VERSION}"
+wget "https://github.com/appc/docker2aci/releases/download/${DOCKER2ACI_VERSION}/docker2aci-${DOCKER2ACI_VERSION}.tar.gz" &> /dev/null
+echo "Extracting docker2aci ${DOCKER2ACI_VERSION}"
+tar xzf docker2aci-${DOCKER2ACI_VERSION}.tar.gz
+ACI_IMAGE=$(${DOWNLOAD_DIR}/docker2aci-${DOCKER2ACI_VERSION}/docker2aci ${DOCKER_IMAGE} 2>/dev/null | tail -n 1)
+cp ${ACI_IMAGE} ${ACI_DIR}/${MOUNTER_ACI_IMAGE}
+
+# Upload the contents to gcs
+echo "Uploading rkt artifacts in ${RKT_DIR} to ${RKT_GCS_DIR}"
+gsutil cp -R ${RKT_DIR} ${RKT_GCS_DIR}
+echo "Uploading gci mounter ACI in ${ACI_DIR} to ${MOUNTER_GCS_DIR}"
+gsutil cp ${ACI_DIR}/${MOUNTER_ACI_IMAGE} ${MOUNTER_GCS_DIR}
+
+echo "Upload completed"
+echo "Update rkt, stag1-fly.aci & gci-mounter ACI versions and SHA1 in cluster/gce/gci/configure.sh"
+echo "${RKT_VERSION}/rkt sha1: $(sha1sum ${RKT_DIR}/rkt)"
+echo "${RKT_VERSION}/stage1-fly.aci sha1: $(sha1sum ${RKT_DIR}/stage1-fly.aci)"
+echo "${MOUNTER_ACI_IMAGE} hash: $(sha1sum ${ACI_DIR}/${MOUNTER_ACI_IMAGE})"
--- a/vendor/k8s.io/kubernetes/cluster/gce/trusty/configure-helper.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/trusty/configure-helper.sh
@ -155,7 +155,7 @@ assemble_kubelet_flags() {
    if [ ! -z "${KUBELET_APISERVER:-}" ] && \
       [ ! -z "${KUBELET_CERT:-}" ] && \
       [ ! -z "${KUBELET_KEY:-}" ]; then
-      KUBELET_CMD_FLAGS="${KUBELET_CMD_FLAGS} --api-servers=https://${KUBELET_APISERVER} --register-schedulable=false --pod-cidr=10.123.45.0/29"
+      KUBELET_CMD_FLAGS="${KUBELET_CMD_FLAGS} --api-servers=https://${KUBELET_APISERVER} --register-schedulable=false"
    else
      KUBELET_CMD_FLAGS="${KUBELET_CMD_FLAGS} --pod-cidr=${MASTER_IP_RANGE}"
    fi
@ -428,6 +428,15 @@ create_master_kubelet_auth() {
  fi
 }

+function create-master-etcd-auth {
+  if [[ -n "${ETCD_CA_CERT:-}" && -n "${ETCD_PEER_KEY:-}" && -n "${ETCD_PEER_CERT:-}" ]]; then
+    local -r auth_dir="/etc/srv/kubernetes"
+    echo "${ETCD_CA_CERT}" | base64 --decode | gunzip > "${auth_dir}/etcd-ca.crt"
+    echo "${ETCD_PEER_KEY}" | base64 --decode > "${auth_dir}/etcd-peer.key"
+    echo "${ETCD_PEER_CERT}" | base64 --decode | gunzip > "${auth_dir}/etcd-peer.crt"
+  fi
+}
+
 # Replaces the variables in the etcd manifest file with the real values, and then
 # copy the file to the manifest dir
 # $1: value for variable 'suffix'
@ -439,14 +448,23 @@ prepare_etcd_manifest() {
  local host_name=$(hostname)
  local etcd_cluster=""
  local cluster_state="new"
+  local etcd_protocol="http"
+  local etcd_creds=""
+
+  if [[ -n "${ETCD_CA_KEY:-}" && -n "${ETCD_CA_CERT:-}" && -n "${ETCD_PEER_KEY:-}" && -n "${ETCD_PEER_CERT:-}" ]]; then
+    etcd_creds=" --peer-trusted-ca-file /etc/srv/kubernetes/etcd-ca.crt --peer-cert-file /etc/srv/kubernetes/etcd-peer.crt --peer-key-file /etc/srv/kubernetes/etcd-peer.key -peer-client-cert-auth "
+    etcd_protocol="https"
+  fi
+
  for host in $(echo "${INITIAL_ETCD_CLUSTER:-${host_name}}" | tr "," "\n"); do
-    etcd_host="etcd-${host}=http://${host}:$3"
+    etcd_host="etcd-${host}=${etcd_protocol}://${host}:$3"
    if [[ -n "${etcd_cluster}" ]]; then
      etcd_cluster+=","
      cluster_state="existing"
    fi
    etcd_cluster+="${etcd_host}"
  done
+
  etcd_temp_file="/tmp/$5"
  cp /home/kubernetes/kube-manifests/kubernetes/gci-trusty/etcd.manifest "${etcd_temp_file}"
  remove_salt_config_comments "${etcd_temp_file}"
@ -454,15 +472,23 @@ prepare_etcd_manifest() {
  sed -i -e "s@{{ *port *}}@$2@g" "${etcd_temp_file}"
  sed -i -e "s@{{ *server_port *}}@$3@g" "${etcd_temp_file}"
  sed -i -e "s@{{ *cpulimit *}}@\"$4\"@g" "${etcd_temp_file}"
+  sed -i -e "s@{{ *srv_kube_path *}}@/etc/srv/kubernetes@g" "${etcd_temp_file}"
  sed -i -e "s@{{ *hostname *}}@$host_name@g" "${etcd_temp_file}"
  sed -i -e "s@{{ *etcd_cluster *}}@$etcd_cluster@g" "${etcd_temp_file}"
  sed -i -e "s@{{ *storage_backend *}}@${STORAGE_BACKEND:-}@g" "${temp_file}"
+  if [[ "${STORAGE_BACKEND:-}" == "etcd3" ]]; then
+    sed -i -e "s@{{ *quota_bytes *}}@--quota-backend-bytes=4294967296@g" "${temp_file}"
+  else
+    sed -i -e "s@{{ *quota_bytes *}}@@g" "${temp_file}"
+  fi
  sed -i -e "s@{{ *cluster_state *}}@$cluster_state@g" "${etcd_temp_file}"
  if [[ -n "${ETCD_IMAGE:-}" ]]; then
    sed -i -e "s@{{ *pillar\.get('etcd_docker_tag', '\(.*\)') *}}@${ETCD_IMAGE}@g" "${etcd_temp_file}"
  else
    sed -i -e "s@{{ *pillar\.get('etcd_docker_tag', '\(.*\)') *}}@\1@g" "${etcd_temp_file}"
  fi
+  sed -i -e "s@{{ *etcd_protocol *}}@$etcd_protocol@g" "${etcd_temp_file}"
+  sed -i -e "s@{{ *etcd_creds *}}@$etcd_creds@g" "${etcd_temp_file}"
  if [[ -n "${ETCD_VERSION:-}" ]]; then
    sed -i -e "s@{{ *pillar\.get('etcd_version', '\(.*\)') *}}@${ETCD_VERSION}@g" "${etcd_temp_file}"
  else
@ -561,6 +587,10 @@ start_kube_apiserver() {
    params="${params} --storage-backend=${STORAGE_BACKEND}"
  fi
  if [ -n "${NUM_NODES:-}" ]; then
+    # If the cluster is large, increase max-requests-inflight limit in apiserver.
+    if [[ "${NUM_NODES}" -ge 1000 ]]; then
+      params+=" --max-requests-inflight=1500"
+    fi
    # Set amount of memory available for apiserver based on number of nodes.
    # TODO: Once we start setting proper requests and limits for apiserver
    # we should reuse the same logic here instead of current heuristic.
@ -598,6 +628,8 @@ start_kube_apiserver() {
    params="${params} --advertise-address=${vm_external_ip}"
    params="${params} --ssh-user=${PROXY_SSH_USER}"
    params="${params} --ssh-keyfile=/etc/srv/sshproxy/.sshkeyfile"
+  else [ -n "${MASTER_ADVERTISE_ADDRESS:-}" ]
+    params="${params} --advertise-address=${MASTER_ADVERTISE_ADDRESS}"
  fi
  readonly kube_apiserver_docker_tag=$(cat /home/kubernetes/kube-docker-files/kube-apiserver.docker_tag)

@ -822,11 +854,8 @@ start_kube_addons() {
    setup_addon_manifests "addons" "${file_dir}"
    # Replace the salt configurations with variable values.
    base_metrics_memory="140Mi"
-    metrics_memory="${base_metrics_memory}"
    base_eventer_memory="190Mi"
    base_metrics_cpu="80m"
-    metrics_cpu="${base_metrics_cpu}"
-    eventer_memory="${base_eventer_memory}"
    nanny_memory="90Mi"
    readonly metrics_memory_per_node="4"
    readonly metrics_cpu_per_node="0.5"
@ -834,10 +863,7 @@ start_kube_addons() {
    readonly nanny_memory_per_node="200"
    if [ -n "${NUM_NODES:-}" ] && [ "${NUM_NODES}" -ge 1 ]; then
      num_kube_nodes="$((${NUM_NODES}+1))"
-      metrics_memory="$((${num_kube_nodes} * ${metrics_memory_per_node} + 200))Mi"
-      eventer_memory="$((${num_kube_nodes} * ${eventer_memory_per_node} + 200 * 1024))Ki"
      nanny_memory="$((${num_kube_nodes} * ${nanny_memory_per_node} + 90 * 1024))Ki"
-      metrics_cpu=$(echo - | awk "{print ${num_kube_nodes} * ${metrics_cpu_per_node} + 80}")m
    fi
    controller_yaml="${addon_dst_dir}/${file_dir}"
    if [ "${ENABLE_CLUSTER_MONITORING:-}" = "googleinfluxdb" ]; then
@ -847,11 +873,8 @@ start_kube_addons() {
    fi
    remove_salt_config_comments "${controller_yaml}"
    sed -i -e "s@{{ *base_metrics_memory *}}@${base_metrics_memory}@g" "${controller_yaml}"
-    sed -i -e "s@{{ *metrics_memory *}}@${metrics_memory}@g" "${controller_yaml}"
    sed -i -e "s@{{ *base_metrics_cpu *}}@${base_metrics_cpu}@g" "${controller_yaml}"
-    sed -i -e "s@{{ *metrics_cpu *}}@${metrics_cpu}@g" "${controller_yaml}"
    sed -i -e "s@{{ *base_eventer_memory *}}@${base_eventer_memory}@g" "${controller_yaml}"
-    sed -i -e "s@{{ *eventer_memory *}}@${eventer_memory}@g" "${controller_yaml}"
    sed -i -e "s@{{ *metrics_memory_per_node *}}@${metrics_memory_per_node}@g" "${controller_yaml}"
    sed -i -e "s@{{ *eventer_memory_per_node *}}@${eventer_memory_per_node}@g" "${controller_yaml}"
    sed -i -e "s@{{ *nanny_memory *}}@${nanny_memory}@g" "${controller_yaml}"
@ -870,10 +893,13 @@ start_kube_addons() {
    mv "${addon_dst_dir}/dns/skydns-rc.yaml.in" "${dns_rc_file}"
    mv "${addon_dst_dir}/dns/skydns-svc.yaml.in" "${dns_svc_file}"
    # Replace the salt configurations with variable values.
-    sed -i -e "s@{{ *pillar\['dns_replicas'\] *}}@${DNS_REPLICAS}@g" "${dns_rc_file}"
    sed -i -e "s@{{ *pillar\['dns_domain'\] *}}@${DNS_DOMAIN}@g" "${dns_rc_file}"
    sed -i -e "s@{{ *pillar\['dns_server'\] *}}@${DNS_SERVER_IP}@g" "${dns_svc_file}"

+    if [[ "${ENABLE_DNS_HORIZONTAL_AUTOSCALER:-}" == "true" ]]; then
+      setup_addon_manifests "addons" "dns-horizontal-autoscaler"
+    fi
+
    if [[ "${FEDERATION:-}" == "true" ]]; then
      FEDERATIONS_DOMAIN_MAP="${FEDERATIONS_DOMAIN_MAP:-}"
      if [[ -z "${FEDERATIONS_DOMAIN_MAP}" && -n "${FEDERATION_NAME:-}" && -n "${DNS_ZONE_NAME:-}" ]]; then
--- a/vendor/k8s.io/kubernetes/cluster/gce/trusty/master.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/gce/trusty/master.yaml
@ -65,6 +65,8 @@ script
 	create_master_auth
 	echo "Creating master instance kubelet auth file"
 	create_master_kubelet_auth
+	echo "Creating auth files for etcd"
+	create-master-etcd-auth
 	echo "Assemble kubelet command line"
 	# Kubelet command flags will be written in /etc/default/kubelet
 	assemble_kubelet_flags
--- a/vendor/k8s.io/kubernetes/cluster/gce/upgrade.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/upgrade.sh
@ -68,6 +68,11 @@ function usage() {
  echo "  ci/latest:      ${0} ${ci_latest}"
 }

+function print-node-version-info() {
+  echo "== $1 Node OS and Kubelet Versions =="
+  "${KUBE_ROOT}/cluster/kubectl.sh" get nodes -o=jsonpath='{range .items[*]}name: "{.metadata.name}", osImage: "{.status.nodeInfo.osImage}", kubeletVersion: "{.status.nodeInfo.kubeletVersion}"{"\n"}{end}'
+}
+
 function upgrade-master() {
  echo "== Upgrading master to '${SERVER_BINARY_TAR_URL}'. Do not interrupt, deleting master instance. =="

@ -363,6 +368,8 @@ if [[ "${master_upgrade}" == "false" ]] && [[ "${node_upgrade}" == "false" ]]; t
  exit 1
 fi

+print-node-version-info "Pre-Upgrade"
+
 if [[ "${local_binaries}" == "false" ]]; then
  set_binary_version ${1}
 fi
@ -389,3 +396,5 @@ fi

 echo "== Validating cluster post-upgrade =="
 "${KUBE_ROOT}/cluster/validate-cluster.sh"
+
+print-node-version-info "Post-Upgrade"
--- a/vendor/k8s.io/kubernetes/cluster/gce/util.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gce/util.sh
@ -614,7 +614,7 @@ function kube-up() {
  if [[ ${KUBE_USE_EXISTING_MASTER:-} == "true" ]]; then
    parse-master-env
    create-nodes
-  elif [[ ${KUBE_EXPERIMENTAL_REPLICATE_EXISTING_MASTER:-} == "true" ]]; then
+  elif [[ ${KUBE_REPLICATE_EXISTING_MASTER:-} == "true" ]]; then
    if  [[ "${MASTER_OS_DISTRIBUTION}" != "gci" && "${MASTER_OS_DISTRIBUTION}" != "debian" ]]; then
      echo "Master replication supported only for gci and debian"
      return 1
@ -729,6 +729,98 @@ function get-master-root-disk-size() {
  fi
 }

+# Assumes:
+#   NUM_NODES
+# Sets:
+#   MASTER_DISK_SIZE
+function get-master-disk-size() {
+  if [[ "${NUM_NODES}" -le "1000" ]]; then
+    export MASTER_DISK_SIZE="20GB"
+  else
+    export MASTER_DISK_SIZE="100GB"
+  fi
+}
+
+# Generates SSL certificates for etcd cluster. Uses cfssl program.
+#
+# Assumed vars:
+#   KUBE_TEMP: temporary directory
+#
+# Args:
+#  $1: CA certificate
+#  $2: CA key
+#
+# If CA cert/key is empty, the function will also generate certs for CA.
+#
+# Vars set:
+#   ETCD_CA_KEY_BASE64
+#   ETCD_CA_CERT_BASE64
+#   ETCD_PEER_KEY_BASE64
+#   ETCD_PEER_CERT_BASE64
+#
+function create-etcd-certs {
+  local ca_cert=${1:-}
+  local ca_key=${2:-}
+
+  mkdir -p "${KUBE_TEMP}/cfssl"
+  pushd "${KUBE_TEMP}/cfssl"
+
+  kernel=$(uname -s)
+  case "${kernel}" in
+    Linux)
+      curl -s -L -o cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
+      curl -s -L -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
+      ;;
+    Darwin)
+      curl -s -L -o cfssl https://pkg.cfssl.org/R1.2/cfssl_darwin-amd64
+      curl -s -L -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_darwin-amd64
+      ;;
+    *)
+      echo "Unknown, unsupported platform: ${kernel}." >&2
+      echo "Supported platforms: Linux, Darwin." >&2
+      exit 2
+  esac
+
+  chmod +x cfssl
+  chmod +x cfssljson
+
+  cat >ca-config.json <<EOF
+{
+    "signing": {
+        "default": {
+            "expiry": "168h"
+        },
+        "profiles": {
+            "client-server": {
+                "expiry": "43800h",
+                "usages": [
+                    "signing",
+                    "key encipherment"
+                ]
+            }
+        }
+    }
+}
+EOF
+  if [[ ! -z "${ca_key}" && ! -z "${ca_cert}" ]]; then
+    echo "${ca_key}" | base64 --decode > ca-key.pem
+    echo "${ca_cert}" | base64 --decode | gunzip > ca.pem
+  else
+    ./cfssl print-defaults csr > ca-csr.json
+    ./cfssl gencert -initca ca-csr.json | ./cfssljson -bare ca -
+  fi
+
+  echo '{"CN":"'"${MASTER_NAME}"'","hosts":[""],"key":{"algo":"ecdsa","size":256}}' \
+      | ./cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client-server -hostname="${MASTER_NAME}" - \
+      | ./cfssljson -bare etcd
+
+  ETCD_CA_KEY_BASE64=$(cat "ca-key.pem" | base64 | tr -d '\r\n')
+  ETCD_CA_CERT_BASE64=$(cat "ca.pem" | gzip | base64 | tr -d '\r\n')
+  ETCD_PEER_KEY_BASE64=$(cat "etcd-key.pem" | base64 | tr -d '\r\n')
+  ETCD_PEER_CERT_BASE64=$(cat "etcd.pem" | gzip | base64 | tr -d '\r\n')
+  popd
+}
+
 function create-master() {
  echo "Starting master and configuring firewalls"
  gcloud compute firewall-rules create "${MASTER_NAME}-https" \
@ -739,6 +831,7 @@ function create-master() {

  # We have to make sure the disk is created before creating the master VM, so
  # run this in the foreground.
+  get-master-disk-size
  gcloud compute disks create "${MASTER_NAME}-pd" \
    --project "${PROJECT}" \
    --zone "${ZONE}" \
@ -782,8 +875,10 @@ function create-master() {
  fi

  KUBERNETES_MASTER_NAME="${MASTER_RESERVED_IP}"
+  MASTER_ADVERTISE_ADDRESS="${MASTER_RESERVED_IP}"

  create-certs "${MASTER_RESERVED_IP}"
+  create-etcd-certs

  # Sets MASTER_ROOT_DISK_SIZE that is used by create-master-instance
  get-master-root-disk-size
@ -809,7 +904,7 @@ function add-replica-to-etcd() {
    --project "${PROJECT}" \
    --zone "${EXISTING_MASTER_ZONE}" \
    --command \
-      "curl localhost:${client_port}/v2/members -XPOST -H \"Content-Type: application/json\" -d '{\"peerURLs\":[\"http://${REPLICA_NAME}:${internal_port}\"]}'"
+      "curl localhost:${client_port}/v2/members -XPOST -H \"Content-Type: application/json\" -d '{\"peerURLs\":[\"https://${REPLICA_NAME}:${internal_port}\"]}'"
  return $?
 }

@ -846,6 +941,7 @@ function replicate-master() {

  # We have to make sure the disk is created before creating the master VM, so
  # run this in the foreground.
+  get-master-disk-size
  gcloud compute disks create "${REPLICA_NAME}-pd" \
    --project "${PROJECT}" \
    --zone "${ZONE}" \
--- a/vendor/k8s.io/kubernetes/cluster/gke/config-default.sh
+++ b/vendor/k8s.io/kubernetes/cluster/gke/config-default.sh
@ -41,4 +41,7 @@ ENABLE_L7_LOADBALANCING="${KUBE_ENABLE_L7_LOADBALANCING:-glbc}"
 #   standalone     - Heapster only. Metrics available via Heapster REST API.
 ENABLE_CLUSTER_MONITORING="${KUBE_ENABLE_CLUSTER_MONITORING:-standalone}"

+# Optional: Enable DNS horizontal autoscaler
+ENABLE_DNS_HORIZONTAL_AUTOSCALER="${KUBE_ENABLE_DNS_HORIZONTAL_AUTOSCALER:-false}"
+
 KUBE_DELETE_NETWORK=${KUBE_DELETE_NETWORK:-false}
--- a/vendor/k8s.io/kubernetes/cluster/images/etcd/Makefile
+++ b/vendor/k8s.io/kubernetes/cluster/images/etcd/Makefile
@ -15,7 +15,7 @@
 # Build the etcd image
 #
 # Usage:
-# 	[TAGS=2.2.1 2.3.7 3.0.13] [REGISTRY=gcr.io/google_containers] [ARCH=amd64] [BASEIMAGE=busybox] make (build|push)
+# 	[TAGS=2.2.1 2.3.7 3.0.14] [REGISTRY=gcr.io/google_containers] [ARCH=amd64] [BASEIMAGE=busybox] make (build|push)

 # The image contains different etcd versions to simplify
 # upgrades. Thus be careful when removing any tag from here.
@ -26,8 +26,8 @@
 # Except from etcd-$(tag) and etcdctl-$(tag) binaries, we also
 # need etcd and etcdctl binaries for backward compatibility reasons.
 # That binary will be set to the last tag from $(TAGS).
-TAGS?=2.2.1 2.3.7 3.0.13
-REGISTRY_TAG?=3.0.13
+TAGS?=2.2.1 2.3.7 3.0.14
+REGISTRY_TAG?=3.0.14
 ARCH?=amd64
 REGISTRY?=gcr.io/google_containers
 GOLANG_VERSION?=1.6.3
--- a/vendor/k8s.io/kubernetes/cluster/images/etcd/migrate-if-needed.sh
+++ b/vendor/k8s.io/kubernetes/cluster/images/etcd/migrate-if-needed.sh
@ -18,7 +18,7 @@
 # This script performs etcd upgrade based on the following environmental
 # variables:
 # TARGET_STORAGE - API of etcd to be used (supported: 'etcd2', 'etcd3')
-# TARGET_VERSION - etcd release to be used (supported: '2.2.1', '2.3.7', '3.0.13')
+# TARGET_VERSION - etcd release to be used (supported: '2.2.1', '2.3.7', '3.0.14')
 # DATA_DIRECTORY - directory with etcd data
 #
 # The current etcd version and storage format is detected based on the
@ -27,8 +27,8 @@
 #
 # The update workflow support the following upgrade steps:
 # - 2.2.1/etcd2 -> 2.3.7/etcd2
-# - 2.3.7/etcd2 -> 3.0.13/etcd2
-# - 3.0.13/etcd2 -> 3.0.13/etcd3
+# - 2.3.7/etcd2 -> 3.0.14/etcd2
+# - 3.0.14/etcd2 -> 3.0.14/etcd3
 #
 # NOTE: The releases supported in this script has to match release binaries
 # present in the etcd image (to make this script work correctly).
@ -66,7 +66,7 @@ fi
 # NOTE: SUPPORTED_VERSION has to match release binaries present in the
 # etcd image (to make this script work correctly).
 # We cannot use array since sh doesn't support it.
-SUPPORTED_VERSIONS_STRING="2.2.1 2.3.7 3.0.13"
+SUPPORTED_VERSIONS_STRING="2.2.1 2.3.7 3.0.14"
 SUPPORTED_VERSIONS=$(echo "${SUPPORTED_VERSIONS_STRING}" | tr " " "\n")

 VERSION_FILE="version.txt"
@ -101,23 +101,26 @@ fi
 start_etcd() {
  # Use random ports, so that apiserver cannot connect to etcd.
  ETCD_PORT=18629
-  ETCD_PEER_PORT=18630
+  ETCD_PEER_PORT=2380
  # Avoid collisions between etcd and event-etcd.
  case "${DATA_DIRECTORY}" in
    *event*)
      ETCD_PORT=18631
-      ETCD_PEER_PORT=18632
+      ETCD_PEER_PORT=2381
      ;;
  esac
  local ETCD_CMD="${ETCD:-/usr/local/bin/etcd-${START_VERSION}}"
  local ETCDCTL_CMD="${ETCDCTL:-/usr/local/bin/etcdctl-${START_VERSION}}"
  local API_VERSION="$(echo ${START_STORAGE} | cut -c5-5)"
  if [ "${API_VERSION}" = "2" ]; then
-    ETCDCTL_CMD="${ETCDCTL_CMD} --endpoint=http://127.0.0.1:${ETCD_PORT} set"
+    ETCDCTL_CMD="${ETCDCTL_CMD} --debug --endpoint=http://127.0.0.1:${ETCD_PORT} set"
  else
    ETCDCTL_CMD="${ETCDCTL_CMD} --endpoints=http://127.0.0.1:${ETCD_PORT} put"
  fi
-  ${ETCD_CMD} --data-dir=${DATA_DIRECTORY} \
+  ${ETCD_CMD} \
+    --name="etcd-$(hostname)" \
+    --debug \
+    --data-dir=${DATA_DIRECTORY} \
    --listen-client-urls http://127.0.0.1:${ETCD_PORT} \
    --advertise-client-urls http://127.0.0.1:${ETCD_PORT} \
    --listen-peer-urls http://127.0.0.1:${ETCD_PEER_PORT} \
@ -145,6 +148,18 @@ stop_etcd() {
 ATTACHLEASE="${ATTACHLEASE:-/usr/local/bin/attachlease}"
 ROLLBACK="${ROLLBACK:-/usr/local/bin/rollback}"

+# If we are upgrading from 2.2.1 and this is the first try for upgrade,
+# do the backup to allow restoring from it in case of failed upgrade.
+BACKUP_DIR="${DATA_DIRECTORY}/migration-backup"
+if [ "${CURRENT_VERSION}" = "2.2.1" -a ! -d "${BACKUP_DIR}" ]; then
+  echo "Backup etcd before starting migration"
+  mkdir ${BACKUP_DIR}
+  ETCDCTL_CMD="/usr/local/bin/etcdctl-2.2.1"
+  ETCDCTL_API=2 ${ETCDCTL_CMD} --debug backup --data-dir=${DATA_DIRECTORY} \
+    --backup-dir=${BACKUP_DIR}
+  echo "Backup done in ${BACKUP_DIR}"
+fi
+
 # Do the roll-forward migration if needed.
 # The migration goes as following:
 # 1. for all versions starting one after the current version of etcd
@ -210,6 +225,12 @@ if [ "${CURRENT_STORAGE}" = "etcd3" -a "${TARGET_STORAGE}" = "etcd2" ]; then
    echo "etcd3 -> etcd2 downgrade is supported only between 3.0.x and 2.3.7"
    return 0
  fi
+  echo "Backup and remove all existing v2 data"
+  ROLLBACK_BACKUP_DIR="${DATA_DIRECTORY}.bak"
+  rm -rf "${ROLLBACK_BACKUP_DIR}"
+  mkdir -p "${ROLLBACK_BACKUP_DIR}"
+  cp -r "${DATA_DIRECTORY}" "${ROLLBACK_BACKUP_DIR}"
+  rm -rf "${DATA_DIRECTORY}"/member/snap/*.snap
  echo "Performing etcd3 -> etcd2 rollback"
  ${ROLLBACK} --data-dir "${DATA_DIRECTORY}"
  if [ "$?" -ne "0" ]; then
--- a/vendor/k8s.io/kubernetes/cluster/images/hyperkube/Makefile
+++ b/vendor/k8s.io/kubernetes/cluster/images/hyperkube/Makefile
@ -76,7 +76,7 @@ endif
 	cd ${TEMP_DIR} && sed -i.back "s|BASEIMAGE|${BASEIMAGE}|g" Dockerfile
 	cd ${TEMP_DIR} && sed -i.back "s|CACHEBUST|$(shell uuidgen)|g" Dockerfile
 	cd ${TEMP_DIR} && sed -i.back "s|-amd64|-${ARCH}|g" addons/singlenode/*.yaml addons/multinode/*.yaml
-	cd ${TEMP_DIR} && sed -i.back "s|__PILLAR__DNS__REPLICAS__|1|g;s|__PILLAR__DNS__SERVER__|10.0.0.10|g;" addons/singlenode/skydns*.yaml addons/multinode/skydns*.yaml
+	cd ${TEMP_DIR} && sed -i.back "s|__PILLAR__DNS__SERVER__|10.0.0.10|g" addons/singlenode/skydns*.yaml addons/multinode/skydns*.yaml
 	cd ${TEMP_DIR} && sed -i.back "s|__PILLAR__DNS__DOMAIN__|cluster.local|g;s|__PILLAR__FEDERATIONS__DOMAIN__MAP__||g;" addons/singlenode/skydns*.yaml addons/multinode/skydns*.yaml
 	cd ${TEMP_DIR} && rm -f addons/singlenode/*.back addons/multinode/*.back static-pods/*.back

--- a/vendor/k8s.io/kubernetes/cluster/images/hyperkube/static-pods/addon-manager-multinode.json
+++ b/vendor/k8s.io/kubernetes/cluster/images/hyperkube/static-pods/addon-manager-multinode.json
@ -11,7 +11,7 @@
    "containers": [
      {
        "name": "kube-addon-manager",
-        "image": "REGISTRY/kube-addon-manager-ARCH:v5.2",
+        "image": "REGISTRY/kube-addon-manager-ARCH:v6.0-alpha.1",
        "resources": {
          "requests": {
            "cpu": "5m",
--- a/vendor/k8s.io/kubernetes/cluster/images/hyperkube/static-pods/addon-manager-singlenode.json
+++ b/vendor/k8s.io/kubernetes/cluster/images/hyperkube/static-pods/addon-manager-singlenode.json
@ -11,7 +11,7 @@
    "containers": [
      {
        "name": "kube-addon-manager",
-        "image": "REGISTRY/kube-addon-manager-ARCH:v5.2",
+        "image": "REGISTRY/kube-addon-manager-ARCH:v6.0-alpha.1",
        "resources": {
          "requests": {
            "cpu": "5m",
--- a/vendor/k8s.io/kubernetes/cluster/juju/layers/kubernetes/reactive/k8s.py
+++ b/vendor/k8s.io/kubernetes/cluster/juju/layers/kubernetes/reactive/k8s.py
@ -330,8 +330,6 @@ def gather_sdn_data():
    else:
        # There is no SDN cider fall back to the kubernetes config cidr option.
        pillar['dns_server'] = get_dns_ip(hookenv.config().get('cidr'))
-    # The pillar['dns_server'] value is used the kubedns-svc.yaml file.
-    pillar['dns_replicas'] = 1
    # The pillar['dns_domain'] value is used in the kubedns-rc.yaml
    pillar['dns_domain'] = hookenv.config().get('dns_domain')
    # Use a 'pillar' dictionary so we can reuse the upstream kubedns templates.
--- a/vendor/k8s.io/kubernetes/cluster/juju/layers/kubernetes/templates/kubedns-rc.yaml
+++ b/vendor/k8s.io/kubernetes/cluster/juju/layers/kubernetes/templates/kubedns-rc.yaml
@ -14,25 +14,26 @@

 # Warning: This is a file generated from the base underscore template file: skydns-rc.yaml.base

-apiVersion: v1
-kind: ReplicationController
+apiVersion: extensions/v1beta1
+kind: Deployment
 metadata:
-  name: kube-dns-v20
+  name: kube-dns
  namespace: kube-system
  labels:
    k8s-app: kube-dns
-    version: v20
    kubernetes.io/cluster-service: "true"
 spec:
-  replicas: {{ pillar['dns_replicas'] }}
+  # replicas: not specified here:
+  # 1. In order to make Addon Manager do not reconcile this replicas parameter.
+  # 2. Default is 1.
+  # 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
  selector:
-    k8s-app: kube-dns
-    version: v20
+    matchLabels:
+      k8s-app: kube-dns
  template:
    metadata:
      labels:
        k8s-app: kube-dns
-        version: v20
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
@ -72,8 +73,12 @@ spec:
        # command = "/kube-dns"
        - --domain={{ pillar['dns_domain'] }}.
        - --dns-port=10053
+        - --v=0
        - --kube_master_url=http://{{ private_address }}:8080
        {{ pillar['federations_domain_map'] }}
+        env:
+          - name: PROMETHEUS_PORT
+            value: "10055"
        ports:
        - containerPort: 10053
          name: dns-local
@ -81,6 +86,9 @@ spec:
        - containerPort: 10053
          name: dns-tcp-local
          protocol: TCP
+        - containerPort: 10055
+          name: metrics
+          protocol: TCP
      - name: dnsmasq
        image: gcr.io/google_containers/kube-dnsmasq-{{ arch }}:1.4
        livenessProbe:
@ -104,6 +112,27 @@ spec:
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
+      - name: dnsmasq-metrics
+        image: gcr.io/google_containers/dnsmasq-metrics-amd64:1.0
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 10054
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        args:
+        - --v=2
+        - --logtostderr
+        ports:
+        - containerPort: 10054
+          name: metrics
+          protocol: TCP
+        resources:
+          requests:
+            memory: 10Mi
      - name: healthz
        image: gcr.io/google_containers/exechealthz-{{ arch }}:1.2
        resources:
--- a/Show More
+++ b/Show More