Merge remote-tracking branch 'upstream/master' into dev-1.19

content/zh/docs/concepts/cluster-administration/cluster-administration-overview.md

@@ -47,9 +47,9 @@ Before choosing a guide, here are some considerations:
  - 你是打算在你的电脑上尝试 Kubernetes，还是要构建一个高可用的多节点集群？请选择最适合你需求的发行版。
  - **如果你正在设计一个高可用集群**，请了解[在多个 zones 中配置集群](/docs/concepts/cluster-administration/federation/)。
  - 您正在使用 类似 [Google Kubernetes Engine](https://cloud.google.com/kubernetes-engine/) 这样的**被托管的Kubernetes集群**, 还是**管理您自己的集群**?
- - 你的集群是在**本地**还是**云（IaaS）**上？ Kubernetes 不能直接支持混合集群。作为代替，你可以建立多个集群。
+ - 你的集群是在**本地**还是 **云（IaaS）** 上？ Kubernetes 不能直接支持混合集群。作为代替，你可以建立多个集群。
  - **如果你在本地配置 Kubernetes**，需要考虑哪种[网络模型](/docs/concepts/cluster-administration/networking/)最适合。
- - 你的 Kubernetes 在 **裸金属硬件** 还是 **虚拟机（VMs）**上运行？
+ - 你的 Kubernetes 在 **裸金属硬件** 还是 **虚拟机（VMs）** 上运行？
  - 你**只想运行一个集群**，还是打算**活动开发 Kubernetes 项目代码**？如果是后者，请选择一个活动开发的发行版。某些发行版只提供二进制发布版，但提供更多的选择。
  - 让你自己熟悉运行一个集群所需的[组件](/docs/admin/cluster-components) 。
 

content/zh/docs/concepts/configuration/overview.md

@@ -191,7 +191,7 @@ A desired state of an object is described by a Deployment, and if changes to tha
 <!--
 The [imagePullPolicy](/docs/concepts/containers/images/#updating-images) and the tag of the image affect when the [kubelet](/docs/admin/kubelet/) attempts to pull the specified image.
 -->
-当 [kubelet](/docs/admin/kubelet/)尝试拉取指定的镜像时，[imagePullPolicy](/docs/concepts/containers/images/#updating-images)和镜像的标签会生效。
+当 [kubelet](/docs/admin/kubelet/)尝试拉取指定的镜像时，[imagePullPolicy](/docs/concepts/containers/images/#升级镜像)和镜像标签会生效。
 
 <!--
 - `imagePullPolicy: IfNotPresent`: the image is pulled only if it is not already present locally.
@@ -206,18 +206,17 @@ The [imagePullPolicy](/docs/concepts/containers/images/#updating-images) and the
 <!--
 - `imagePullPolicy` is omitted and either the image tag is `:latest` or it is omitted: `Always` is applied.
 -->
-- 省略`imagePullPolicy`，镜像标签为`:latest`或被省略，`Always`被应用。
+- `imagePullPolicy` 省略时，镜像标签为 `:latest` 或不存在，使用 `Always` 值。
 
 <!--
 - `imagePullPolicy` is omitted and the image tag is present but not `:latest`: `IfNotPresent` is applied.
 -->
-- `imagePullPolicy`被省略，并且镜像的标签被指定且不是`:latest`，`IfNotPresent`被应用。
+- `imagePullPolicy` 省略时，指定镜像标签并且不是 `:latest`，使用 `IfNotPresent` 值。
 
 <!--
 - `imagePullPolicy: Never`: the image is assumed to exist locally. No attempt is made to pull the image.
 -->
-- `imagePullPolicy: Never`：镜像被假设存在于本地。
-  没有尝试拉取镜像。
+- `imagePullPolicy: Never`：假设镜像已经存在本地，不会尝试拉取镜像。
 
 <!--
 To make sure the container always uses the same version of the image, you can specify its [digest](https://docs.docker.com/engine/reference/commandline/pull/#pull-an-image-by-digest-immutable-identifier), for example `sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2`. The digest uniquely identifies a specific version of the image, so it is never updated by Kubernetes unless you change the digest value.

content/zh/docs/concepts/workloads/controllers/statefulset.md

@@ -227,7 +227,7 @@ Cluster Domain will be set to `cluster.local` unless
 [otherwise configured](/docs/concepts/services-networking/dns-pod-service/#how-it-works).
 -->
 {{< note >}}
-集群域会被设置为 `cluster.local`，除非有[其他配置](/docs/concepts/services-networking/dns-pod-service/#how-it-works)。
+集群域会被设置为 `cluster.local`，除非有[其他配置](/docs/concepts/services-networking/dns-pod-service/)。
 {{< /note >}}
 
 <!--

content/zh/docs/concepts/workloads/pods/pod-topology-spread-constraints.md

@@ -182,10 +182,10 @@ If we want an incoming Pod to be evenly spread with existing Pods across zones,
 {{< codenew file="pods/topology-spread-constraints/one-constraint.yaml" >}}
 
 <!--
-`topologyKey: zone` implies the even distribution will only be applied to the nodes which have label pair "zone:<any value>" present. `whenUnsatisfiable: DoNotSchedule` tells the scheduler to let it stay pending if the incoming Pod can’t satisfy the constraint.
+`topologyKey: zone` implies the even distribution will only be applied to the nodes which have label pair "zone:&lt;any value&gt;" present. `whenUnsatisfiable: DoNotSchedule` tells the scheduler to let it stay pending if the incoming Pod can’t satisfy the constraint.
 -->
 
-`topologyKey: zone` 意味着均匀分布将只应用于存在标签对为 "zone:<any value>" 的节点上。`whenUnsatisfiable: DoNotSchedule` 告诉调度器，如果传入的 pod 不满足约束，则让它保持挂起状态。
+`topologyKey: zone` 意味着均匀分布将只应用于存在标签对为 "zone:&lt;any value&gt;" 的节点上。`whenUnsatisfiable: DoNotSchedule` 告诉调度器，如果传入的 pod 不满足约束，则让它保持挂起状态。
 
 <!--
 If the scheduler placed this incoming Pod into "zoneA", the Pods distribution would become [3, 1], hence the actual skew is 2 (3 - 1) - which violates `maxSkew: 1`. In this example, the incoming Pod can only be placed onto "zoneB":
@@ -321,13 +321,17 @@ There are some implicit conventions worth noting here:
 - If the incoming Pod has `spec.nodeSelector` or `spec.affinity.nodeAffinity` defined, nodes not matching them will be bypassed.
 -->
 
-- 如果传入的 pod 定义了 `spec.nodeSelector` 或 `spec.affinity.nodeAffinity`，则将忽略不匹配的节点。
-
 <!--
     Suppose you have a 5-node cluster ranging from zoneA to zoneC:
 -->
 
-假设有一个从 zonea 到 zonec 的 5 节点集群：
+<!--
+    and you know that "zoneC" must be excluded. In this case, you can compose the yaml as below, so that "mypod" will be placed onto "zoneB" instead of "zoneC". Similarly `spec.nodeSelector` is also respected.
+-->
+
+- 如果传入的 pod 定义了 `spec.nodeSelector` 或 `spec.affinity.nodeAffinity`，则将忽略不匹配的节点。
+
+    假设有一个从 zonea 到 zonec 的 5 节点集群：
 
     ```
     +---------------+---------------+-------+
@@ -339,11 +343,7 @@ There are some implicit conventions worth noting here:
     +-------+-------+-------+-------+-------+
     ```
 
-<!--
-    and you know that "zoneC" must be excluded. In this case, you can compose the yaml as below, so that "mypod" will be placed onto "zoneB" instead of "zoneC". Similarly `spec.nodeSelector` is also respected.
--->
-
-你知道 "zoneC" 必须被排除在外。在这种情况下，可以按如下方式编写 yaml，以便将 "mypod" 放置在 "zoneB" 上，而不是 "zoneC" 上。同样，`spec.nodeSelector` 也要一样处理。
+    你知道 "zoneC" 必须被排除在外。在这种情况下，可以按如下方式编写 yaml，以便将 "mypod" 放置在 "zoneB" 上，而不是 "zoneC" 上。同样，`spec.nodeSelector` 也要一样处理。
 
     {{< codenew file="pods/topology-spread-constraints/one-constraint-with-nodeaffinity.yaml" >}}
 

content/zh/docs/reference/access-authn-authz/extensible-admission-controllers.md

@@ -2018,7 +2018,7 @@ In the cases above, the webhook can be safely reinvoked, or admit an object that
 
 2. 对于 `CREATE` Pod 请求，如果未设置容器的字段 `.spec.containers[].resources.limits`，设置默认资源限制值。
 
-3. 对于 `CREATE` pod 请求，盲目地添加一个名为 `foo-sidecar` 的 sidecar 容器，而未查看 Pod 中是否已经有 `foo-sidecar` 容器。
+3. 对于 `CREATE` pod 请求，如果 Pod 中不存在名为 `foo-sidecar` 的 sidecar 容器，向 Pod 注入一个 `foo-sidecar` 容器。
 
 在上述情况下，可以安全地重新调用 Webhook，或接受已经设置了字段的对象。