Merge branch 'master' into adjust-node-hostname-docs

docs/admin/addons.md

@@ -15,7 +15,7 @@ Add-ons in each section are sorted alphabetically - the ordering does not imply
 * [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy.
 * [Flannel](https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml) is a overlay network provider that can be used with Kubernetes.
 * [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API](/docs/user-guide/networkpolicies/). Kubeadm add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize).
-* [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database.
+* [Weave Net](https://www.weave.works/docs/net/latest/kube-addon/) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database.
 
 ## Visualization & Control
 

docs/admin/authentication.md

@@ -6,7 +6,8 @@ assignees:
 - deads2k
 
 ---
-
+* TOC
+{:toc}
 
 ## Users in Kubernetes
 
@@ -33,7 +34,7 @@ or be treated as an anonymous user.
 
 ## Authentication strategies
 
-Kubernetes uses client certificates, bearer tokens, or HTTP basic auth to
+Kubernetes uses client certificates, bearer tokens, an authenticating proxy, or HTTP basic auth to
 authenticate API requests through authentication plugins. As HTTP request are
 made to the API server plugins attempts to associate the following attributes
 with the request:
@@ -360,6 +361,20 @@ An unsuccessful request would return:
 
 HTTP status codes can be used to supply additional error context.
 
+
+### Authenticating Proxy
+
+The API server can be configured to identify users from request header values, such as `X-Remote-User`.
+It is designed for use in combination with an authenticating proxy, which sets the request header value.
+In order to prevent header spoofing, the authenticating proxy is required to present a valid client
+certificate to the API server for validation against the specified CA before the request headers are 
+checked.
+
+* `--requestheader-username-headers` Required, case-insensitive. Header names to check, in order, for the user identity. The first header containing a value is used as the identity.
+* `--requestheader-client-ca-file` Required. PEM-encoded certificate bundle. A valid client certificate must be presented and validated against the certificate authorities in the specified file before the request headers are checked for user names.
+* `--requestheader-allowed-names` Optional.  List of common names (cn). If set, a valid client certificate with a Common Name (cn) in the specified list must be presented before the request headers are checked for user names. If empty, any Common Name is allowed. 
+
+
 ### Keystone Password
 
 Keystone authentication is enabled by passing the `--experimental-keystone-url=<AuthURL>`

docs/admin/dns.md

@@ -160,6 +160,7 @@ kubectl get pods busybox
 ```
 
 You should see:
+
 ```
 NAME      READY     STATUS    RESTARTS   AGE
 busybox   1/1       Running   0          <some-time>

docs/admin/high-availability/index.md

@@ -100,16 +100,15 @@ for `${NODE_IP}` on each machine.
 
 #### Validating your cluster
 
-Once you copy this into all three nodes, you should have a clustered etcd set up.  You can validate with
-
+Once you copy this into all three nodes, you should have a clustered etcd set up.  You can validate on master with
 ```shell
-etcdctl member list
+kubectl exec < pod_name > etcdctl member list
 ```
 
 and
 
 ```shell
-etcdctl cluster-health
+kubectl exec < pod_name > etcdctl cluster-health
 ```
 
 You can also validate that this is working with `etcdctl set foo bar` on one node, and `etcdctl get foo`

docs/admin/networking.md

@@ -177,7 +177,7 @@ complicated way to build an overlay network.  This is endorsed by several of the
 
 ### Project Calico
 
-[Project Calico](https://github.com/projectcalico/calico-containers/blob/master/docs/cni/kubernetes/README.md) is an open source container networking provider and network policy engine.
+[Project Calico](http://docs.projectcalico.org/) is an open source container networking provider and network policy engine.
 
 Calico provides a highly scalable networking and network policy solution for connecting Kubernetes pods based on the same IP networking principles as the internet.  Calico can be deployed without encapsulation or overlays to provide high-performance, high-scale data center networking.  Calico also provides fine-grained, intent based network security policy for Kubernetes pods via its distributed firewall.