```release-note
kube-apiserver: --service-account-lookup now defaults to true. This enables service account tokens to be revoked by deleting the Secret object containing the token.
```
Automatic merge from submit-queue (batch tested with PRs 40932, 41896, 41815, 41309, 41628)
enable DefaultTolerationSeconds admission controller by default
**What this PR does / why we need it**:
Continuation of PR #41414, enable DefaultTolerationSeconds admission controller by default.
**Which issue this PR fixes**:
fixes: #41860
related Issue: #1574, #25320
related PRs: #34825, #41133, #41414
**Special notes for your reviewer**:
**Release note**:
```release-note
enable DefaultTolerationSeconds admission controller by default
```
The admission controller adds a default class to PVCs that do not require any
specific class. This way, users (=PVC authors) do not need to care about
storage classes, administrator can configure a default one and all these PVCs
that do not care about class will get the default one.
Allows loading existing auth from kubeconfig on kube-up if a
valid KUBE_CONTEXT is specified, instead of always force
regenerating auth (basic or token) when creating a new cluster.
In order to make the etcd instances of the VMs join into a single cluster,
we used to use the discovery mechanism.
This made the cluster bootstrap dependent on an external etcd cluster instance.
74601ea replaced the dependency on discovery.etcd.io by a local etcd cluster.
This change completely gets rid of the dynamic discovery mechanism in favor
of the static configuration method.
This should be both safe and light since it completely removes the need of having
an external etcd cluster running somewhere (either discovery.etcd.io, or locally).
KUBERNETES=libvirt-coreos cluster/kube-up.sh produced the following error:
cluster/../cluster/libvirt-coreos/../../cluster/common.sh: line 83: user_args[@]: unbound variable
This was coming from the fact that, as a libvirt-coreos cluster runs locally on local VMs,
there is no authentication mechanism. This led to have user_args of common.sh unset.
In the case of libvirt-coreos, it is in fact expected to have no authentication token.
Whereas CoreOS is still shipped with etcd 0.4.9, kubernetes has moved to etcd 2.0.4.
This version mismatch makes kubernetes unable to use etcd.
Kubernetes’ logs are full of “502: (unhandled http status [Temporary Redirect] with body []) [0]”
This change makes libvirt-coreos cluster explicitly use etcd v2.0.9 instead of the one shipped within CoreOS.
This change aims at being reverted once CoreOS will migrate to etcd 2.
This migration is tracked at:
https://github.com/coreos/bugs/issues/317
