merge upstream master

content/en/docs/reference/access-authn-authz/admission-controllers.md

@@ -81,6 +81,20 @@ The Kubernetes API server flag `disable-admission-plugins` takes a comma-delimit
 kube-apiserver --disable-admission-plugins=PodNodeSelector,AlwaysDeny ...
 ```
 
+## Which plugins are enabled by default?
+
+To see which admission plugins are enabled:
+
+```shell
+kube-apiserver -h | grep enable-admission-plugins
+```
+
+In 1.11, they are:
+ 
+```shell
+NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,Priority
+```
+
 ## What does each admission controller do?
 
 ### AlwaysAdmit (DEPRECATED) {#alwaysadmit}

content/en/docs/reference/access-authn-authz/authentication.md

@@ -342,7 +342,7 @@ Setup instructions for specific systems:
 
 The first option is to use the kubectl `oidc` authenticator, which sets the `id_token` as a bearer token for all requests and refreshes the token once it expires. After you've logged into your provider, use kubectl to add your `id_token`, `refresh_token`, `client_id`, and `client_secret` to configure the plugin.
 
-Providers that don't return an `id_token` as part of their refresh token response (e.g. [Okta](https://developer.okta.com/docs/api/resources/oidc.html#response-parameters-4)) aren't supported by this plugin and should use "Option 2" below.
+Providers that don't return an `id_token` as part of their refresh token response aren't supported by this plugin and should use "Option 2" below.
 
 ```bash
 kubectl config set-credentials USER_NAME \

content/en/docs/reference/access-authn-authz/rbac.md

@@ -452,7 +452,7 @@ Auto-reconciliation is enabled in Kubernetes version 1.6+ when the RBAC authoriz
 
 ### Discovery Roles
 
-Default role bindings authorize unauthenticated and authenticated users to read API information that is deemed safe to be publicly accessible. To disable anonymous unauthenticated access add `--anonymous-auth=false` to the API server configuration.
+Default role bindings authorize unauthenticated and authenticated users to read API information that is deemed safe to be publicly accessible (including CustomResourceDefinitions). To disable anonymous unauthenticated access add `--anonymous-auth=false` to the API server configuration.
 
 To view the configuration of these roles via `kubectl` run:
 

content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md

@@ -114,6 +114,9 @@ For more details on each field in the configuration you can navigate to our
 For information about kube-proxy parameters in the kubeadm configuration see:
 - [kube-proxy](https://godoc.org/k8s.io/kubernetes/pkg/proxy/apis/config#KubeProxyConfiguration)
 
+For information about enabling IPVS mode with kubeadm see:
+- [IPVS](https://github.com/kubernetes/kubernetes/blob/master/pkg/proxy/ipvs/README.md)
+
 ### Passing custom flags to control plane components {#control-plane-flags}
 
 For information about passing flags to control plane components see: