Merge branch 'release-1.9' of https://github.com/kubernetes/website into release-1.9

docs/concepts/cluster-administration/cloud-providers.md

@@ -64,20 +64,20 @@ the underlying cloud, where available:
 
 | Service                  | API Version(s) | Required |
 |--------------------------|----------------|----------|
-| Block Storage (Cinder)   | V1†, V2        | No       |
+| Block Storage (Cinder)   | V1†, V2, V3    | No       |
 | Compute (Nova)           | V2             | No       |
 | Identity (Keystone)      | V2‡,  V3       | Yes      |
 | Load Balancing (Neutron) | V1§, V2        | No       |
+| Load Balancing (Octavia) | V2             | No       |
 
-† Block Storage V1 API support is deprecated, support for Block Storage V3 will 
+† Block Storage V1 API support is deprecated, Block Storage V3 API support was
-be added in the future.
+added in Kubernetes 1.9.
 
 ‡ Identity V2 API support is deprecated and will be removed from the provider in
 a future release. As of the "Queens" release, OpenStack will no longer expose the
 Identity V2 API.
 
-§ Load Balancing V1 API support is deprecated and will be removed from the
+§ Load Balancing V1 API support was removed in Kubernetes 1.9.
-provider in a future release.
 
 Service discovery is achieved by listing the service catalog managed by
 OpenStack Identity (Keystone) using the `auth-url` provided in the provider

docs/concepts/policy/pod-security-policy.md

@@ -40,6 +40,7 @@ administrator to control the following:
 | Running of a container that allow privilege escalation from its parent     | [`allowPrivilegeEscalation`](#allowprivilegeescalation)               |
 | Control whether a process can gain more privileges than its parent process | [`defaultAllowPrivilegeEscalation`](#defaultallowprivilegeescalation) |
 | Whitelist of allowed host paths                                            | [`allowedHostPaths`](#allowedhostpaths)                               |
+| Whitelist of the flex volume drivers                                       | [`allowedFlexVolumes`](#allowedflexvolumes)                           |
 
 _Pod Security Policies_ are comprised of settings and strategies that
 control the security features a pod has access to. These settings fall
@@ -162,6 +163,26 @@ spec:
     - pathPrefix: "/foo"
 ```
 
+### AllowedFlexVolumes
+
+This specifies a whitelist of flex volume drivers that are allowed
+to be used by flexVolume. An empty list means there is no restriction on the drivers. Please
+make sure `volumes` contains the `flexVolume` volume type, no flex volume driver is allowed
+otherwise. For example:
+
+```yaml
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: allow-flex-volumes
+spec:
+  volumes:
+  - flexVolume
+  allowedFlexVolumes:
+  - driver: example/lvm
+  - driver: example/cifs
+```
+
 ## Admission
 
 [_Admission control_ with `PodSecurityPolicy`](/docs/admin/admission-controllers/#podsecuritypolicy)

docs/concepts/storage/volumes.md

@@ -939,7 +939,7 @@ achieved by using the `FlexVolume` plugin.
 `FlexVolume` enables users to mount vendor volumes into a pod. The vendor plugin
 is implemented using a driver, an executable supporting a list of volume commands
 defined by the `FlexVolume` API. Drivers must be installed in a pre-defined
-volume plugin path on each node. This is an alpha feature and may change in future.
+volume plugin path on each node.
 
 More details can be found [here](https://github.com/kubernetes/community/blob/master/contributors/devel/flexvolume.md).