Merge branch 'master' into patch-1

.gitignore

@@ -5,3 +5,4 @@ _site/**
 .sass-cache/**
 CNAME
 .travis.yml
+.idea/

404.md

@@ -2,67 +2,10 @@
 layout: docwithnav
 title: 404 Error!
 permalink: /404.html
+no_canonical: true
+sitemap: false
 ---
-<script language="JavaScript">
+
-$( document ).ready(function() {
+<script src="/js/redirects.js"></script>
-  var oldURLs=["/README.md","/README.html",".html",".md","/v1.1/","/v1.0/"];
-  var fwdDirs=["examples/","cluster/","docs/devel","docs/design"];
-  var doRedirect = false;
-  var notHere = false;
-  var forwardingURL=window.location.href;
-  if (forwardingURL.indexOf("third_party/swagger-ui") > -1)
-  {
-    notHere = true;
-    window.location.replace("http://kubernetes.io/kubernetes/third_party/swagger-ui/");
-  }
-  if (forwardingURL.indexOf("resource-quota") > -1)
-  {
-    notHere = true;
-    window.location.replace("http://kubernetes.io/docs/admin/resourcequota/");
-  }
-  if (forwardingURL.indexOf("horizontal-pod-autoscaler") > -1)
-  {
-    notHere = true;
-    window.location.replace("http://kubernetes.io/docs/user-guide/horizontal-pod-autoscaling/");
-  } 
-  if (forwardingURL.indexOf("docs/roadmap") > -1)
-  {
-    notHere = true;
-    window.location.replace("https://github.com/kubernetes/kubernetes/milestones/");
-  }
-  if (forwardingURL.indexOf("api-ref/") > -1) 
-  {
-    notHere = true;
-    window.location.replace("http://kubernetes.io/docs/api/");
-  }
-  if (forwardingURL.indexOf("docs/user-guide/overview") > -1)
-  {
-    notHere = true;
-    window.location.replace("http://kubernetes.io/docs/whatisk8s/");
-  }
-  for (i=0;i<fwdDirs.length;i++) {
-    if (forwardingURL.indexOf(fwdDirs[i]) > -1)
-    {
-      var urlPieces = forwardingURL.split(fwdDirs[i]);
-      var newURL = "https://github.com/kubernetes/kubernetes/tree/{{page.githubbranch}}/" + fwdDirs[i] + urlPieces[1];
-      notHere = true;
-      window.location.replace(newURL);
-    }
-  }
-  if (!notHere) {
-    for (i=0;i<oldURLs.length;i++) {
-      if (forwardingURL.indexOf(oldURLs[i]) > -1)
-      {
-        doRedirect=true;
-        forwardingURL=forwardingURL.replace(oldURLs[i],"/");
-      }
-    }
-    if (doRedirect)
-    {
-      window.location.replace(forwardingURL);
-    };
-  }
-});
-</script>
 
 Sorry, this page was not found. :(

CONTRIBUTING.md

@@ -0,0 +1,36 @@
+# Contributing to Kubernetes Documentation
+
+**First off, thanks for taking the time to contribute!**
+
+The following is a set of guidelines for contributing to Kubernetes documentation, hosted at [Kubernetes.io](http://kubernetes.io/).
+These are just guidelines, not rules. Use your best judgment, and feel free to propose changes to this document in a pull request.
+
+## Before you get started
+
+### Code of Conduct
+
+Kubernetes follows the [Cloud Native Computing Foundation (CNCF) Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). By participating, you are expected to uphold this code. Please report unacceptable behavior to Sarah Novotny [sarahnovotny@google.com](mailto:sarahnovotny@google.com) and/or Dan Kohn [dan@linuxfoundation.org](mailto:dan@linuxfoundation.org). 
+
+### Documentation and Site Decisions
+
+The [Kubernetes SIG Docs Discussion Group](https://groups.google.com/forum/#!forum/kubernetes-sig-docs) is the discussion group for doc releases, suggested site improvements, and improving the doc contribution experience. If you are planning to be a regular contributor, join this group to stay informed and involved.
+
+### Style Guides and Templates
+
+Before submitting a pull request to create new content, please review the [Kubernetes.io style guide](http://kubernetes.io/docs/contribute/style-guide/) and follow the [instructions for using page templates](http://kubernetes.io/docs/contribute/page-templates/). 
+
+
+## Contributing to Documentation
+
+### Reporting Documentation Issues
+
+Kubernetes.io uses github issues to track documentation issues and requests. If you see a documentation issue, submit an issue using the following steps:
+
+1. Check the [kubernetes.io issues list](https://github.com/kubernetes/kubernetes.github.io/issues) as you might find out the issue is a duplicate. 
+2. Use the [included template for every new issue](https://github.com/kubernetes/kubernetes.github.io/issues/new).  When you create a bug report, include as many details as possible and include suggested fixes to the issue. 
+
+Note that code issues should be filed against the main kubernetes repository, while documentation issues should go in the kubernetes.io repository. 
+
+### Submitting Documentation Pull Requests
+
+If you're fixing an issue in the existing documentation, you should submit a PR against the master branch.  Follow [these instructions to create a documentation pull request against the kubernetes.io repository](http://kubernetes.io/docs/contribute/create-pull-request/).

Gemfile

@@ -1,20 +1,4 @@
 source "https://rubygems.org"
 
-gem "jekyll", "3.2.1"
+gem "github-pages", group: :jekyll_plugins
-gem "jekyll-sass-converter", "1.3.0"
+gem "jekyll-include-cache", "~> 0.1"
-gem "minima", "1.1.0"
-gem "kramdown", "1.11.1"
-gem "liquid", "3.0.6"
-gem "rouge", "1.11.1"
-gem "jemoji", "0.7.0"
-gem "jekyll-mentions", "1.2.0"
-gem "jekyll-redirect-from", "0.11.0"
-gem "jekyll-sitemap", "0.10.0"
-gem "jekyll-feed", "0.5.1"
-gem "jekyll-gist", "1.4.0"
-gem "jekyll-paginate", "1.1.0"
-gem "jekyll-coffeescript", "1.0.1"
-gem "jekyll-seo-tag", "2.0.0"
-gem "jekyll-github-metadata", "2.0.2"
-gem "listen", "3.0.6"
-gem "activesupport", "4.2.7"

Gemfile.lock

@@ -7,23 +7,75 @@ GEM
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
-    addressable (2.4.0)
+    addressable (2.5.0)
+      public_suffix (~> 2.0, >= 2.0.2)
     coffee-script (2.4.1)
       coffee-script-source
       execjs
-    coffee-script-source (1.10.0)
+    coffee-script-source (1.12.2)
     colorator (1.1.0)
+    ethon (0.10.1)
+      ffi (>= 1.3.0)
     execjs (2.7.0)
-    faraday (0.9.2)
+    faraday (0.10.0)
       multipart-post (>= 1.2, < 3)
     ffi (1.9.14)
     forwardable-extended (2.6.0)
     gemoji (2.1.0)
+    github-pages (112)
+      activesupport (= 4.2.7)
+      github-pages-health-check (= 1.3.0)
+      jekyll (= 3.3.1)
+      jekyll-avatar (= 0.4.2)
+      jekyll-coffeescript (= 1.0.1)
+      jekyll-default-layout (= 0.1.4)
+      jekyll-feed (= 0.8.0)
+      jekyll-gist (= 1.4.0)
+      jekyll-github-metadata (= 2.2.0)
+      jekyll-mentions (= 1.2.0)
+      jekyll-optional-front-matter (= 0.1.2)
+      jekyll-paginate (= 1.1.0)
+      jekyll-readme-index (= 0.0.3)
+      jekyll-redirect-from (= 0.11.0)
+      jekyll-relative-links (= 0.2.1)
+      jekyll-sass-converter (= 1.3.0)
+      jekyll-seo-tag (= 2.1.0)
+      jekyll-sitemap (= 0.12.0)
+      jekyll-swiss (= 0.4.0)
+      jekyll-theme-architect (= 0.0.3)
+      jekyll-theme-cayman (= 0.0.3)
+      jekyll-theme-dinky (= 0.0.3)
+      jekyll-theme-hacker (= 0.0.3)
+      jekyll-theme-leap-day (= 0.0.3)
+      jekyll-theme-merlot (= 0.0.3)
+      jekyll-theme-midnight (= 0.0.3)
+      jekyll-theme-minimal (= 0.0.3)
+      jekyll-theme-modernist (= 0.0.3)
+      jekyll-theme-primer (= 0.1.5)
+      jekyll-theme-slate (= 0.0.3)
+      jekyll-theme-tactile (= 0.0.3)
+      jekyll-theme-time-machine (= 0.0.3)
+      jekyll-titles-from-headings (= 0.1.3)
+      jemoji (= 0.7.0)
+      kramdown (= 1.11.1)
+      liquid (= 3.0.6)
+      listen (= 3.0.6)
+      mercenary (~> 0.3)
+      minima (= 2.0.0)
+      rouge (= 1.11.1)
+      terminal-table (~> 1.4)
+    github-pages-health-check (1.3.0)
+      addressable (~> 2.3)
+      net-dns (~> 0.8)
+      octokit (~> 4.0)
+      public_suffix (~> 2.0)
+      typhoeus (~> 0.7)
     html-pipeline (2.4.2)
       activesupport (>= 2)
       nokogiri (>= 1.4)
     i18n (0.7.0)
-    jekyll (3.2.1)
+    jekyll (3.3.1)
+      addressable (~> 2.4)
       colorator (~> 1.0)
       jekyll-sass-converter (~> 1.0)
       jekyll-watch (~> 1.1)
@@ -33,26 +85,69 @@ GEM
       pathutil (~> 0.9)
       rouge (~> 1.7)
       safe_yaml (~> 1.0)
+    jekyll-avatar (0.4.2)
+      jekyll (~> 3.0)
     jekyll-coffeescript (1.0.1)
       coffee-script (~> 2.2)
-    jekyll-feed (0.5.1)
+    jekyll-default-layout (0.1.4)
+      jekyll (~> 3.0)
+    jekyll-feed (0.8.0)
+      jekyll (~> 3.3)
     jekyll-gist (1.4.0)
       octokit (~> 4.2)
-    jekyll-github-metadata (2.0.2)
+    jekyll-github-metadata (2.2.0)
       jekyll (~> 3.1)
-      octokit (~> 4.0)
+      octokit (~> 4.0, != 4.4.0)
+    jekyll-include-cache (0.1.0)
+      jekyll (~> 3.3)
     jekyll-mentions (1.2.0)
       activesupport (~> 4.0)
       html-pipeline (~> 2.3)
       jekyll (~> 3.0)
+    jekyll-optional-front-matter (0.1.2)
+      jekyll (~> 3.0)
     jekyll-paginate (1.1.0)
+    jekyll-readme-index (0.0.3)
+      jekyll (~> 3.0)
     jekyll-redirect-from (0.11.0)
       jekyll (>= 2.0)
+    jekyll-relative-links (0.2.1)
+      jekyll (~> 3.3)
     jekyll-sass-converter (1.3.0)
       sass (~> 3.2)
-    jekyll-seo-tag (2.0.0)
+    jekyll-seo-tag (2.1.0)
-      jekyll (~> 3.1)
+      jekyll (~> 3.3)
-    jekyll-sitemap (0.10.0)
+    jekyll-sitemap (0.12.0)
+      jekyll (~> 3.3)
+    jekyll-swiss (0.4.0)
+    jekyll-theme-architect (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-cayman (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-dinky (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-hacker (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-leap-day (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-merlot (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-midnight (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-minimal (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-modernist (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-primer (0.1.5)
+      jekyll (~> 3.3)
+    jekyll-theme-slate (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-tactile (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-time-machine (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-titles-from-headings (0.1.3)
+      jekyll (~> 3.3)
     jekyll-watch (1.5.0)
       listen (~> 3.0, < 3.1)
     jemoji (0.7.0)
@@ -68,52 +163,41 @@ GEM
       rb-inotify (>= 0.9.7)
     mercenary (0.3.6)
     mini_portile2 (2.1.0)
-    minima (1.1.0)
+    minima (2.0.0)
-    minitest (5.9.0)
+    minitest (5.10.1)
     multipart-post (2.0.0)
-    nokogiri (1.6.8)
+    net-dns (0.8.0)
+    nokogiri (1.6.8.1)
       mini_portile2 (~> 2.1.0)
-      pkg-config (~> 1.1.7)
+    octokit (4.6.2)
-    octokit (4.3.0)
+      sawyer (~> 0.8.0, >= 0.5.3)
-      sawyer (~> 0.7.0, >= 0.5.3)
     pathutil (0.14.0)
       forwardable-extended (~> 2.6)
-    pkg-config (1.1.7)
+    public_suffix (2.0.4)
-    rb-fsevent (0.9.7)
+    rb-fsevent (0.9.8)
     rb-inotify (0.9.7)
       ffi (>= 0.5.0)
     rouge (1.11.1)
     safe_yaml (1.0.4)
-    sass (3.4.22)
+    sass (3.4.23)
-    sawyer (0.7.0)
+    sawyer (0.8.1)
-      addressable (>= 2.3.5, < 2.5)
+      addressable (>= 2.3.5, < 2.6)
-      faraday (~> 0.8, < 0.10)
+      faraday (~> 0.8, < 1.0)
+    terminal-table (1.7.3)
+      unicode-display_width (~> 1.1.1)
     thread_safe (0.3.5)
+    typhoeus (0.8.0)
+      ethon (>= 0.8.0)
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
+    unicode-display_width (1.1.2)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  activesupport (= 4.2.7)
+  github-pages
-  jekyll (= 3.2.1)
+  jekyll-include-cache (~> 0.1)
-  jekyll-coffeescript (= 1.0.1)
-  jekyll-feed (= 0.5.1)
-  jekyll-gist (= 1.4.0)
-  jekyll-github-metadata (= 2.0.2)
-  jekyll-mentions (= 1.2.0)
-  jekyll-paginate (= 1.1.0)
-  jekyll-redirect-from (= 0.11.0)
-  jekyll-sass-converter (= 1.3.0)
-  jekyll-seo-tag (= 2.0.0)
-  jekyll-sitemap (= 0.10.0)
-  jemoji (= 0.7.0)
-  kramdown (= 1.11.1)
-  liquid (= 3.0.6)
-  listen (= 3.0.6)
-  minima (= 1.1.0)
-  rouge (= 1.11.1)
 
 BUNDLED WITH
-   1.11.2
+   1.13.6

LICENSE

@@ -1,201 +1,395 @@
-Apache License
+Attribution 4.0 International
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
 
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+=======================================================================
 
-   1. Definitions.
+Creative Commons Corporation ("Creative Commons") is not a law firm and
+does not provide legal services or legal advice. Distribution of
+Creative Commons public licenses does not create a lawyer-client or
+other relationship. Creative Commons makes its licenses and related
+information available on an "as-is" basis. Creative Commons gives no
+warranties regarding its licenses, any material licensed under their
+terms and conditions, or any related information. Creative Commons
+disclaims all liability for damages resulting from their use to the
+fullest extent possible.
 
-      "License" shall mean the terms and conditions for use, reproduction,
+Using Creative Commons Public Licenses
-      and distribution as defined by Sections 1 through 9 of this document.
 
-      "Licensor" shall mean the copyright owner or entity authorized by
+Creative Commons public licenses provide a standard set of terms and
-      the copyright owner that is granting the License.
+conditions that creators and other rights holders may use to share
+original works of authorship and other material subject to copyright
+and certain other rights specified in the public license below. The
+following considerations are for informational purposes only, are not
+exhaustive, and do not form part of our licenses.
 
-      "Legal Entity" shall mean the union of the acting entity and all
+     Considerations for licensors: Our public licenses are
-      other entities that control, are controlled by, or are under common
+     intended for use by those authorized to give the public
-      control with that entity. For the purposes of this definition,
+     permission to use material in ways otherwise restricted by
-      "control" means (i) the power, direct or indirect, to cause the
+     copyright and certain other rights. Our licenses are
-      direction or management of such entity, whether by contract or
+     irrevocable. Licensors should read and understand the terms
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+     and conditions of the license they choose before applying it.
-      outstanding shares, or (iii) beneficial ownership of such entity.
+     Licensors should also secure all rights necessary before
+     applying our licenses so that the public can reuse the
+     material as expected. Licensors should clearly mark any
+     material not subject to the license. This includes other CC-
+     licensed material, or material used under an exception or
+     limitation to copyright. More considerations for licensors:
+	wiki.creativecommons.org/Considerations_for_licensors
 
-      "You" (or "Your") shall mean an individual or Legal Entity
+     Considerations for the public: By using one of our public
-      exercising permissions granted by this License.
+     licenses, a licensor grants the public permission to use the
+     licensed material under specified terms and conditions. If
+     the licensor's permission is not necessary for any reason--for
+     example, because of any applicable exception or limitation to
+     copyright--then that use is not regulated by the license. Our
+     licenses grant only permissions under copyright and certain
+     other rights that a licensor has authority to grant. Use of
+     the licensed material may still be restricted for other
+     reasons, including because others have copyright or other
+     rights in the material. A licensor may make special requests,
+     such as asking that all changes be marked or described.
+     Although not required by our licenses, you are encouraged to
+     respect those requests where reasonable. More_considerations
+     for the public: 
+	wiki.creativecommons.org/Considerations_for_licensees
 
-      "Source" form shall mean the preferred form for making modifications,
+=======================================================================
-      including but not limited to software source code, documentation
-      source, and configuration files.
 
-      "Object" form shall mean any form resulting from mechanical
+Creative Commons Attribution 4.0 International Public License
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
 
-      "Work" shall mean the work of authorship, whether in Source or
+By exercising the Licensed Rights (defined below), You accept and agree
-      Object form, made available under the License, as indicated by a
+to be bound by the terms and conditions of this Creative Commons
-      copyright notice that is included in or attached to the work
+Attribution 4.0 International Public License ("Public License"). To the
-      (an example is provided in the Appendix below).
+extent this Public License may be interpreted as a contract, You are
+granted the Licensed Rights in consideration of Your acceptance of
+these terms and conditions, and the Licensor grants You such rights in
+consideration of benefits the Licensor receives from making the
+Licensed Material available under these terms and conditions.
 
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
 
-      "Contribution" shall mean any work of authorship, including
+Section 1 -- Definitions.
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
 
-      "Contributor" shall mean Licensor and any individual or Legal Entity
+  a. Adapted Material means material subject to Copyright and Similar
-      on behalf of whom a Contribution has been received by Licensor and
+     Rights that is derived from or based upon the Licensed Material
-      subsequently incorporated within the Work.
+     and in which the Licensed Material is translated, altered,
+     arranged, transformed, or otherwise modified in a manner requiring
+     permission under the Copyright and Similar Rights held by the
+     Licensor. For purposes of this Public License, where the Licensed
+     Material is a musical work, performance, or sound recording,
+     Adapted Material is always produced where the Licensed Material is
+     synched in timed relation with a moving image.
 
-   2. Grant of Copyright License. Subject to the terms and conditions of
+  b. Adapter's License means the license You apply to Your Copyright
-      this License, each Contributor hereby grants to You a perpetual,
+     and Similar Rights in Your contributions to Adapted Material in
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+     accordance with the terms and conditions of this Public License.
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
 
-   3. Grant of Patent License. Subject to the terms and conditions of
+  c. Copyright and Similar Rights means copyright and/or similar rights
-      this License, each Contributor hereby grants to You a perpetual,
+     closely related to copyright including, without limitation,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+     performance, broadcast, sound recording, and Sui Generis Database
-      (except as stated in this section) patent license to make, have made,
+     Rights, without regard to how the rights are labeled or
-      use, offer to sell, sell, import, and otherwise transfer the Work,
+     categorized. For purposes of this Public License, the rights
-      where such license applies only to those patent claims licensable
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
-      by such Contributor that are necessarily infringed by their
+     Rights.
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
 
-   4. Redistribution. You may reproduce and distribute copies of the
+  d. Effective Technological Measures means those measures that, in the
-      Work or Derivative Works thereof in any medium, with or without
+     absence of proper authority, may not be circumvented under laws
-      modifications, and in Source or Object form, provided that You
+     fulfilling obligations under Article 11 of the WIPO Copyright
-      meet the following conditions:
+     Treaty adopted on December 20, 1996, and/or similar international
+     agreements.
 
-      (a) You must give any other recipients of the Work or
+  e. Exceptions and Limitations means fair use, fair dealing, and/or
-          Derivative Works a copy of this License; and
+     any other exception or limitation to Copyright and Similar Rights
+     that applies to Your use of the Licensed Material.
 
-      (b) You must cause any modified files to carry prominent notices
+  f. Licensed Material means the artistic or literary work, database,
-          stating that You changed the files; and
+     or other material to which the Licensor applied this Public
+     License.
 
-      (c) You must retain, in the Source form of any Derivative Works
+  g. Licensed Rights means the rights granted to You subject to the
-          that You distribute, all copyright, patent, trademark, and
+     terms and conditions of this Public License, which are limited to
-          attribution notices from the Source form of the Work,
+     all Copyright and Similar Rights that apply to Your use of the
-          excluding those notices that do not pertain to any part of
+     Licensed Material and that the Licensor has authority to license.
-          the Derivative Works; and
 
-      (d) If the Work includes a "NOTICE" text file as part of its
+  h. Licensor means the individual(s) or entity(ies) granting rights
-          distribution, then any Derivative Works that You distribute must
+     under this Public License.
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
 
-      You may add Your own copyright statement to Your modifications and
+  i. Share means to provide material to the public by any means or
-      may provide additional or different license terms and conditions
+     process that requires permission under the Licensed Rights, such
-      for use, reproduction, or distribution of Your modifications, or
+     as reproduction, public display, public performance, distribution,
-      for any such Derivative Works as a whole, provided Your use,
+     dissemination, communication, or importation, and to make material
-      reproduction, and distribution of the Work otherwise complies with
+     available to the public including in ways that members of the
-      the conditions stated in this License.
+     public may access the material from a place and at a time
+     individually chosen by them.
 
-   5. Submission of Contributions. Unless You explicitly state otherwise,
+  j. Sui Generis Database Rights means rights other than copyright
-      any Contribution intentionally submitted for inclusion in the Work
+     resulting from Directive 96/9/EC of the European Parliament and of
-      by You to the Licensor shall be under the terms and conditions of
+     the Council of 11 March 1996 on the legal protection of databases,
-      this License, without any additional terms or conditions.
+     as amended and/or succeeded, as well as other essentially
-      Notwithstanding the above, nothing herein shall supersede or modify
+     equivalent rights anywhere in the world.
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
 
-   6. Trademarks. This License does not grant permission to use the trade
+  k. You means the individual or entity exercising the Licensed Rights
-      names, trademarks, service marks, or product names of the Licensor,
+     under this Public License. Your has a corresponding meaning.
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
 
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
 
-   8. Limitation of Liability. In no event and under no legal theory,
+Section 2 -- Scope.
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
 
-   9. Accepting Warranty or Additional Liability. While redistributing
+  a. License grant.
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
 
-   END OF TERMS AND CONDITIONS
+       1. Subject to the terms and conditions of this Public License,
+          the Licensor hereby grants You a worldwide, royalty-free,
+          non-sublicensable, non-exclusive, irrevocable license to
+          exercise the Licensed Rights in the Licensed Material to:
 
-   APPENDIX: How to apply the Apache License to your work.
+            a. reproduce and Share the Licensed Material, in whole or
+               in part; and
 
-      To apply the Apache License to your work, attach the following
+            b. produce, reproduce, and Share Adapted Material.
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
 
-   Copyright 2016 The Kubernetes Authors
+       2. Exceptions and Limitations. For the avoidance of doubt, where
+          Exceptions and Limitations apply to Your use, this Public
+          License does not apply, and You do not need to comply with
+          its terms and conditions.
 
-   Licensed under the Apache License, Version 2.0 (the "License");
+       3. Term. The term of this Public License is specified in Section
-   you may not use this file except in compliance with the License.
+          6(a).
-   You may obtain a copy of the License at
 
-       http://www.apache.org/licenses/LICENSE-2.0
+       4. Media and formats; technical modifications allowed. The
+          Licensor authorizes You to exercise the Licensed Rights in
+          all media and formats whether now known or hereafter created,
+          and to make technical modifications necessary to do so. The
+          Licensor waives and/or agrees not to assert any right or
+          authority to forbid You from making technical modifications
+          necessary to exercise the Licensed Rights, including
+          technical modifications necessary to circumvent Effective
+          Technological Measures. For purposes of this Public License,
+          simply making modifications authorized by this Section 2(a)
+          (4) never produces Adapted Material.
 
-   Unless required by applicable law or agreed to in writing, software
+       5. Downstream recipients.
-   distributed under the License is distributed on an "AS IS" BASIS,
+
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+            a. Offer from the Licensor -- Licensed Material. Every
-   See the License for the specific language governing permissions and
+               recipient of the Licensed Material automatically
-   limitations under the License.
+               receives an offer from the Licensor to exercise the
+               Licensed Rights under the terms and conditions of this
+               Public License.
+
+            b. No downstream restrictions. You may not offer or impose
+               any additional or different terms or conditions on, or
+               apply any Effective Technological Measures to, the
+               Licensed Material if doing so restricts exercise of the
+               Licensed Rights by any recipient of the Licensed
+               Material.
+
+       6. No endorsement. Nothing in this Public License constitutes or
+          may be construed as permission to assert or imply that You
+          are, or that Your use of the Licensed Material is, connected
+          with, or sponsored, endorsed, or granted official status by,
+          the Licensor or others designated to receive attribution as
+          provided in Section 3(a)(1)(A)(i).
+
+  b. Other rights.
+
+       1. Moral rights, such as the right of integrity, are not
+          licensed under this Public License, nor are publicity,
+          privacy, and/or other similar personality rights; however, to
+          the extent possible, the Licensor waives and/or agrees not to
+          assert any such rights held by the Licensor to the limited
+          extent necessary to allow You to exercise the Licensed
+          Rights, but not otherwise.
+
+       2. Patent and trademark rights are not licensed under this
+          Public License.
+
+       3. To the extent possible, the Licensor waives any right to
+          collect royalties from You for the exercise of the Licensed
+          Rights, whether directly or through a collecting society
+          under any voluntary or waivable statutory or compulsory
+          licensing scheme. In all other cases the Licensor expressly
+          reserves any right to collect such royalties.
+
+
+Section 3 -- License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the
+following conditions.
+
+  a. Attribution.
+
+       1. If You Share the Licensed Material (including in modified
+          form), You must:
+
+            a. retain the following if it is supplied by the Licensor
+               with the Licensed Material:
+
+                 i. identification of the creator(s) of the Licensed
+                    Material and any others designated to receive
+                    attribution, in any reasonable manner requested by
+                    the Licensor (including by pseudonym if
+                    designated);
+
+                ii. a copyright notice;
+
+               iii. a notice that refers to this Public License;
+
+                iv. a notice that refers to the disclaimer of
+                    warranties;
+
+                 v. a URI or hyperlink to the Licensed Material to the
+                    extent reasonably practicable;
+
+            b. indicate if You modified the Licensed Material and
+               retain an indication of any previous modifications; and
+
+            c. indicate the Licensed Material is licensed under this
+               Public License, and include the text of, or the URI or
+               hyperlink to, this Public License.
+
+       2. You may satisfy the conditions in Section 3(a)(1) in any
+          reasonable manner based on the medium, means, and context in
+          which You Share the Licensed Material. For example, it may be
+          reasonable to satisfy the conditions by providing a URI or
+          hyperlink to a resource that includes the required
+          information.
+
+       3. If requested by the Licensor, You must remove any of the
+          information required by Section 3(a)(1)(A) to the extent
+          reasonably practicable.
+
+       4. If You Share Adapted Material You produce, the Adapter's
+          License You apply must not prevent recipients of the Adapted
+          Material from complying with this Public License.
+
+
+Section 4 -- Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that
+apply to Your use of the Licensed Material:
+
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
+     to extract, reuse, reproduce, and Share all or a substantial
+     portion of the contents of the database;
+
+  b. if You include all or a substantial portion of the database
+     contents in a database in which You have Sui Generis Database
+     Rights, then the database in which You have Sui Generis Database
+     Rights (but not its individual contents) is Adapted Material; and
+
+  c. You must comply with the conditions in Section 3(a) if You Share
+     all or a substantial portion of the contents of the database.
+
+For the avoidance of doubt, this Section 4 supplements and does not
+replace Your obligations under this Public License where the Licensed
+Rights include other Copyright and Similar Rights.
+
+
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
+
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
+
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
+
+  c. The disclaimer of warranties and limitation of liability provided
+     above shall be interpreted in a manner that, to the extent
+     possible, most closely approximates an absolute disclaimer and
+     waiver of all liability.
+
+
+Section 6 -- Term and Termination.
+
+  a. This Public License applies for the term of the Copyright and
+     Similar Rights licensed here. However, if You fail to comply with
+     this Public License, then Your rights under this Public License
+     terminate automatically.
+
+  b. Where Your right to use the Licensed Material has terminated under
+     Section 6(a), it reinstates:
+
+       1. automatically as of the date the violation is cured, provided
+          it is cured within 30 days of Your discovery of the
+          violation; or
+
+       2. upon express reinstatement by the Licensor.
+
+     For the avoidance of doubt, this Section 6(b) does not affect any
+     right the Licensor may have to seek remedies for Your violations
+     of this Public License.
+
+  c. For the avoidance of doubt, the Licensor may also offer the
+     Licensed Material under separate terms or conditions or stop
+     distributing the Licensed Material at any time; however, doing so
+     will not terminate this Public License.
+
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
+     License.
+
+
+Section 7 -- Other Terms and Conditions.
+
+  a. The Licensor shall not be bound by any additional or different
+     terms or conditions communicated by You unless expressly agreed.
+
+  b. Any arrangements, understandings, or agreements regarding the
+     Licensed Material not stated herein are separate from and
+     independent of the terms and conditions of this Public License.
+
+
+Section 8 -- Interpretation.
+
+  a. For the avoidance of doubt, this Public License does not, and
+     shall not be interpreted to, reduce, limit, restrict, or impose
+     conditions on any use of the Licensed Material that could lawfully
+     be made without permission under this Public License.
+
+  b. To the extent possible, if any provision of this Public License is
+     deemed unenforceable, it shall be automatically reformed to the
+     minimum extent necessary to make it enforceable. If the provision
+     cannot be reformed, it shall be severed from this Public License
+     without affecting the enforceability of the remaining terms and
+     conditions.
+
+  c. No term or condition of this Public License will be waived and no
+     failure to comply consented to unless expressly agreed to by the
+     Licensor.
+
+  d. Nothing in this Public License constitutes or may be interpreted
+     as a limitation upon, or waiver of, any privileges and immunities
+     that apply to the Licensor or You, including from the legal
+     processes of any jurisdiction or authority.
+
+
+=======================================================================
+
+Creative Commons is not a party to its public
+licenses. Notwithstanding, Creative Commons may elect to apply one of
+its public licenses to material it publishes and in those instances
+will be considered the "Licensor." The text of the Creative Commons
+public licenses is dedicated to the public domain under the CC0 Public
+Domain Dedication. Except for the limited purpose of indicating that
+material is shared under a Creative Commons public license or as
+otherwise permitted by the Creative Commons policies published at
+creativecommons.org/policies, Creative Commons does not authorize the
+use of the trademark "Creative Commons" or any other trademark or logo
+of Creative Commons without its prior written consent including,
+without limitation, in connection with any unauthorized modifications
+to any of its public licenses or any other arrangements,
+understandings, or agreements concerning use of licensed material. For
+the avoidance of doubt, this paragraph does not form part of the
+public licenses.
+
+Creative Commons may be contacted at creativecommons.org.

README.md

@@ -1,194 +1,19 @@
-## Instructions for Contributing to the Docs/Website
+## Instructions for Contributing to the Kubernetes Documentation
 
-Welcome! We are very pleased you want to contribute to the documentation and/or website for Kubernetes.
+Welcome! We are very pleased you want to contribute to the Kubernetes documentation.
 
-You can click the "Fork" button in the upper-right area of the screen to create a copy of our site on your GitHub account called a "fork." Make any changes you want in your fork, and when you are ready to send those changes to us, go to the index page for your fork and click "New Pull Request" to let us know about it.
+You can click the **Fork** button in the upper-right area of the screen to create a copy of this repository in your GitHub account called a *fork*. Make any changes you want in your fork, and when you are ready to send those changes to us, go to your fork and create a new pull request to let us know about it.
 
-## Staging the site on GitHub Pages
+For more information about contributing to the Kubernetes documentation, see:
 
-If you want to see your changes staged without having to install anything locally, remove the CNAME file in this directory and
+* [Contributing to the Kubernetes Documentation](http://kubernetes.io/editdocs/)
-change the name of the fork to be:
+* [Creating a Documentation Pull Request](http://kubernetes.io/docs/contribute/create-pull-request/)
-
+* [Writing a New Topic](http://kubernetes.io/docs/contribute/write-new-topic/)
-    YOUR_GITHUB_USERNAME.github.io
+* [Staging Your Documentation Changes](http://kubernetes.io/docs/contribute/stage-documentation-changes/)
-
+* [Using Page Templates](http://kubernetes.io/docs/contribute/page-templates/)
-Then make your changes.
+* [Documentation Style Guide](http://kubernetes.io/docs/contribute/style-guide/)
-
-When you visit [http://YOUR_GITHUB_USERNAME.github.io](http://YOUR_GITHUB_USERNAME.github.io) you should see a special-to-you version of the site that contains the changes you just made.
-
-## Staging the site locally (using Docker)
-
-Don't like installing stuff? Download and run a local staging server with a single `docker run` command. 
-
-    git clone https://github.com/kubernetes/kubernetes.github.io.git
-    cd kubernetes.github.io
-    docker run -ti --rm -v "$PWD":/k8sdocs -p 4000:4000 gcr.io/google-samples/k8sdocs:1.0
-
-Then visit [http://localhost:4000](http://localhost:4000) to see our site. Any changes you make on your local machine will be automatically staged.
-
-If you're interested you can view [the Dockerfile for this image](https://github.com/kubernetes/kubernetes.github.io/blob/master/staging-container/Dockerfile).
-
-## Staging the site locally (from scratch setup)
-
-The below commands to setup your environment for running GitHub pages locally. Then, any edits you make will be viewable
-on a lightweight webserver that runs on your local machine.
-
-This will typically be the fastest way (by far) to iterate on docs changes and see them staged, once you get this set up, but it does involve several install steps that take awhile to complete, and makes system-wide modifications.
-
-Install Ruby 2.2 or higher. If you're on Linux, run these commands:
-
-    apt-get install software-properties-common
-    apt-add-repository ppa:brightbox/ruby-ng
-    apt-get install ruby2.2
-    apt-get install ruby2.2-dev
-
-* If you're on a Mac, follow [these instructions](https://gorails.com/setup/osx/). 
-* If you're on a Windows machine you can use the [Ruby Installer](http://rubyinstaller.org/downloads/). During the installation make sure to check the option for *Add Ruby executables to your PATH*.
-
-The remainder of the steps should work the same across operating systems.
-
-To confirm you've installed Ruby correctly, at the command prompt run `gem --version` and you should get a response with your version number. Likewise you can confirm you have Git installed properly by running `git --version`, which will respond with your version of Git.
-
-Install the GitHub Pages package, which includes Jekyll:
-
-	gem install github-pages
-
-Clone our site:
-
-	git clone https://github.com/kubernetes/kubernetes.github.io.git
-
-Make any changes you want. Then, to see your changes locally:
-
-	cd kubernetes.github.io
-	jekyll serve
-
-Your copy of the site will then be viewable at: [http://localhost:4000](http://localhost:4000)
-(or wherever Jekyll tells you).
-
-
-## GitHub help
-
-If you're a bit rusty with git/GitHub, you might want to read
-[this](http://readwrite.com/2013/10/02/github-for-beginners-part-2) for a refresher.
-
-## Common Tasks
-
-### Edit Page Titles or Change the Left Navigation
-
-Edit the yaml files in `/_data/` for the Guides, Reference, Samples, or Support areas.
-
-You may have to exit and `jekyll clean` before restarting the `jekyll serve` to
-get changes to files in `/_data/` to show up.
-
-### Add Images
-
-Put the new image in `/images/docs/` if it's for the documentation, and just `/images/` if it's for the website.
-
-**For diagrams, we greatly prefer SVG files!**
-
-### Include code from another file
-
-To include a file that is hosted on this GitHub repo, insert this code:
-
-<pre>&#123;% include code.html language="&lt;LEXERVALUE&gt;" file="&lt;RELATIVEPATH&gt;" ghlink="&lt;PATHFROMROOT&gt;" %&#125;</pre>
-
-* `LEXERVALUE`: The language in which the file was written; must be [a value supported by Rouge](https://github.com/jneen/rouge/wiki/list-of-supported-languages-and-lexers).
-* `RELATIVEPATH`: The path to the file you're including, relative to the current file.
-* `PATHFROMROOT`: The path to the file relative to root, e.g. `/docs/admin/foo.yaml`
-
-To include a file that is hosted in the external, main Kubernetes repo, make sure it's added to [/update-imported-docs.sh](https://github.com/kubernetes/kubernetes.github.io/blob/master/update-imported-docs.sh), and run it so that the file gets downloaded, then enter:
-
-<pre>&#123;% include code.html language="&lt;LEXERVALUE&gt;" file="&lt;RELATIVEPATH&gt;" k8slink="&lt;PATHFROMK8SROOT&gt;" %&#125;</pre>
-
-* `PATHFROMK8SROOT`: The path to the file relative to the root of [the Kubernetes repo](https://github.com/kubernetes/kubernetes/tree/release-1.2), e.g. `/examples/rbd/foo.yaml`
-
-## Using tabs for multi-language examples
-
-By specifying some inline CSV in a varable called `tabspec`, you can include a file
-called `tabs.html` that generates tabs showing code examples in multiple langauges.
-
-<pre>&#123;% capture tabspec %&#125;servicesample
-JSON,json,service-sample.json,/docs/user-guide/services/service-sample.json
-YAML,yaml,service-sample.yaml,/docs/user-guide/services/service-sample.yaml&#123;% endcapture %&#125;
-&#123;% include tabs.html %&#125;</pre>
-
-In English, this would read: "Create a set of tabs with the alias `servicesample`,
-and have tabs visually labeled "JSON" and "YAML" that use `json` and `yaml` Rouge syntax highlighting, which display the contents of
-`service-sample.{extension}` on the page, and link to the file in GitHub at (full path)."
-
-Example file: [Pods: Multi-Container](http://kubernetes.io/docs/user-guide/pods/multi-container/).
-
-## Use a global variable
-
-The `/_config.yml` file defines some useful variables you can use when editing docs.
-
-* `page.githubbranch`: The name of the GitHub branch on the Kubernetes repo that is associated with this branch of the docs. e.g. `release-1.2`
-* `page.version` The version of Kubernetes associated with this branch of the docs. e.g. `v1.2`
-* `page.docsbranch` The name of the GitHub branch on the Docs/Website repo that you are currently using. e.g. `release-1.1` or `master`
-
-This keeps the docs you're editing aligned with the Kubernetes version you're talking about. For example, if you define a link like so, you'll never have to worry about it going stale in future doc branches:
-
-<pre>View the README [here](http://releases.k8s.io/&#123;&#123;page.githubbranch&#125;&#125;/cluster/addons/README.md).</pre>
-
-That, of course, will send users to:
-
-[http://releases.k8s.io/release-1.2/cluster/addons/README.md](http://releases.k8s.io/release-1.2/cluster/addons/README.md)
-
-(Or whatever Kubernetes release that docs branch is associated with.)
-
-## Branch structure
-
-The current version of the website is served out of the `master` branch.
-
-All versions of the site that relate to past and future versions will be named after their Kubernetes release number. For example, [the old branch for the 1.1 docs is called `release-1.1`](https://github.com/kubernetes/kubernetes.github.io/tree/release-1.1).
-
-Changes in the "docsv2" branch (where we are testing a revamp of the docs) are automatically staged here:
-http://k8sdocs.github.io/docs/tutorials/
-
-Changes in the "release-1.1" branch (for k8s v1.1 docs) are automatically staged here:
-http://kubernetes-v1-1.github.io/
-
-Changes in the "release-1.3" branch (for k8s v1.3 docs) are automatically staged here:
-http://kubernetes-v1-3.github.io/
-
-Editing of these branches will kick off a build using Travis CI that auto-updates these URLs; you can monitor the build progress at [https://travis-ci.org/kubernetes/kubernetes.github.io](https://travis-ci.org/kubernetes/kubernetes.github.io).
-
-## Config yaml guidelines
-
-Guidelines for config yamls that are included in the site docs. These
-are the yaml or json files that contain Kubernetes object
-configuration to be used with `kubectl create -f` Config yamls should
-be:
-
-* Separate deployable files, not embedded in the document, unless very
-  small variations of a full config.
-* Included in the doc with the include code
-  [above.](#include-code-from-another-file)
-* In the same directory as the doc that they are being used in
-  * If you are re-using a yaml from another doc, that is OK, just
-    leave it there, don't move it up to a higher level directory.
-* Tested in
-  [test/examples_test.go](https://github.com/kubernetes/kubernetes.github.io/blob/master/test/examples_test.go)
-* Follows
-  [best practices.](http://kubernetes.io/docs/user-guide/config-best-practices/)
-
-Don't assume the reader has this repository checked out, use `kubectl
-create -f https://github...` in example commands. For Docker images
-used in config yamls, try to use an image from an existing Kubernetes
-example. If creating an image for a doc, follow the
-[example guidelines](https://github.com/kubernetes/kubernetes/blob/master/examples/guidelines.md#throughout)
-section on "Docker images" from the Kubernetes repository.
-
-## Partners
-Kubernetes partners refers to the companies who contribute to the Kubernetes core codebase and/or extend their platform to support Kubernetes. Partners can get their logos added to the partner section of the [community page](http://k8s.io/community) by following the below steps and meeting the below logo specifications. Partners will also need to have a URL that is specific to integrating with Kubernetes ready; this URL will be the destination when the logo is clicked.
-
-* The partner product logo should be a transparent png image centered in a 215x125 px frame. (look at the existing logos for reference)
-* The logo must link to a URL that is specific to integrating with Kubernetes, hosted on the partner's site.
-* The logo should be named *product-name*_logo.png and placed in the `/images/community_logos` folder.
-* The image reference (including the link to the partner URL) should be added in `community.html` under `<div class="partner-logos" > ...</div>`.
-* Please do not change the order of the existing partner images. Append your logo to the end of the list.
-* Once completed and tested the look and feel, submit the pull request.
 
 ## Thank you!
 
-Kubernetes thrives on community participation and we really appreciate your
+Kubernetes thrives on community participation, and we really appreciate your
 contributions to our site and our documentation!

_config.yml

@@ -1,11 +1,12 @@
 name: Kubernetes
+title: Kubernetes
+description: Production-Grade Container Orchestration
 markdown: kramdown
 kramdown:
   input: GFM
   html_to_native: true
   hard_wrap: false
   syntax_highlighter: rouge
-baseurl: /
 incremental: true
 
 safe: false
@@ -16,9 +17,9 @@ defaults:
     scope:
       path: ""
     values:
-      version: "v1.3"
+      version: "v1.5.1"
       githubbranch: "master"
-      docsbranch: "release-1.3"
+      docsbranch: "master"
   -
     scope:
       path: "docs"
@@ -27,3 +28,27 @@ defaults:
       showedit: true
 
 permalink: pretty
+
+gems:
+  - jekyll-redirect-from
+  - jekyll-feed
+  - jekyll-sitemap
+  - jekyll-seo-tag
+  - jekyll-include-cache
+
+# SEO
+logo: /images/favicon.png
+twitter:
+  username: kubernetesio
+
+# Tables of contents, stored in the _data folder, that control the sidebar nav
+tocs:
+  - docs-home
+  - guides
+  - tutorials
+  - tasks
+  - concepts
+  - reference
+  - tools
+  - samples
+  - support

_data/concepts.yml

@@ -1,8 +1,10 @@
 bigheader: "Concepts"
+abstract: "Detailed explanations of Kubernetes system concepts and abstractions."
 toc:
-- title: Concepts
+- docs/concepts/index.md
-  path: /docs/concepts/
 - title: Object Metadata
   section:
-  - title: Annotations
+  - docs/concepts/object-metadata/annotations.md
-    path: /docs/concepts/object-metadata/annotations/
+- title: Controllers
+  section:
+  - docs/concepts/abstractions/controllers/statefulsets.md

_data/docs-home.yml

@@ -0,0 +1,4 @@
+bigheader: "Kubernetes Documentation"
+abstract: "Documentation for using and learning about Kubernetes."
+toc:
+- docs/index.md

_data/globals.yml

@@ -1,8 +1,10 @@
 tocs:
+- docs-home
 - guides
 - tutorials
 - tasks
 - concepts
 - reference
+- tools
 - samples
 - support

_data/guides.yml

@@ -1,300 +1,190 @@
 bigheader: "Guides"
-abstract: "How to get started, and achieve tasks, using Kubernetes"
+abstract: "How to get started, and accomplish tasks, using Kubernetes."
 toc:
-- title: Guides
+- docs/user-guide/index.md
-  path: /docs/
 
 - title: Getting Started
   section:
-  - title: What is Kubernetes?
+  - docs/whatisk8s.md
-    path: /docs/whatisk8s/
+  - docs/getting-started-guides/kubeadm.md
-  - title: Installing Kubernetes on Linux with kubeadm
+  - docs/getting-started-guides/kops.md
-    path: /docs/getting-started-guides/kubeadm/
+  - docs/hellonode.md
-  - title: Hello World on Google Container Engine
+  - docs/getting-started-guides/kubectl.md
-    path: /docs/hellonode/
+  - docs/getting-started-guides/binary_release.md
-  - title: Downloading or Building Kubernetes
-    path: /docs/getting-started-guides/binary_release/
   - title: Online Training Course
     path: https://www.udacity.com/course/scalable-microservices-with-kubernetes--ud615
 
 - title: Accessing the Cluster
   section:
-  - title: Installing and Setting up kubectl
+  - docs/user-guide/prereqs.md
-    path: /docs/user-guide/prereqs/
+  - docs/user-guide/accessing-the-cluster.md
-  - title: Accessing Clusters
+  - docs/user-guide/sharing-clusters.md
-    path: /docs/user-guide/accessing-the-cluster/
+  - docs/user-guide/kubeconfig-file.md
-  - title: Sharing Cluster Access with kubeconfig
-    path: /docs/user-guide/sharing-clusters/
-  - title: Authenticating Across Clusters with kubeconfig
-    path: /docs/user-guide/kubeconfig-file/
 
-- title: User Guide
+- docs/user-guide/index.md
-  path: /docs/user-guide/
 
-- title: Web UI (Dashboard)
+- docs/user-guide/ui.md
-  path: /docs/user-guide/ui/
 
 - title: Workload Deployment and Management
   section:
-  - title: Launching, Exposing, and Killing Applications
+  - docs/user-guide/quick-start.md
-    path: /docs/user-guide/quick-start/
+  - docs/user-guide/deploying-applications.md
-  - title: Deploying Applications
+  - docs/user-guide/managing-deployments.md
-    path: /docs/user-guide/deploying-applications/
+  - docs/user-guide/replication-controller/operations.md
-  - title: Managing Resources
+  - docs/user-guide/resizing-a-replication-controller.md
-    path: /docs/user-guide/managing-deployments/
+  - docs/user-guide/rolling-updates.md
-  - title: Replication Controller Operations
+  - docs/user-guide/update-demo/index.md
-    path: /docs/user-guide/replication-controller/operations/
+  - docs/user-guide/secrets/walkthrough.md
-  - title: Resizing a Replication Controller
+  - docs/user-guide/configmap/index.md
-    path: /docs/user-guide/resizing-a-replication-controller/
+  - docs/user-guide/horizontal-pod-autoscaling/walkthrough.md
-  - title: Rolling Updates
+  - docs/user-guide/config-best-practices.md
-    path: /docs/user-guide/rolling-updates/
+  - docs/user-guide/working-with-resources.md
-  - title: Rolling Update Demo
+  - docs/user-guide/garbage-collection.md
-    path: /docs/user-guide/update-demo/
-  - title: Secrets Walkthrough
-    path: /docs/user-guide/secrets/walkthrough/
-  - title: Using ConfigMap
-    path: /docs/user-guide/configmap/
-  - title: Horizontal Pod Autoscaling
-    path: /docs/user-guide/horizontal-pod-autoscaling/walkthrough/
-  - title: Best Practices for Configuration
-    path: /docs/user-guide/config-best-practices/
-  - title: Using kubectl to Manage Resources
-    path: /docs/user-guide/working-with-resources/
-  - title: Garbage Collection (Beta)
-    path: /docs/user-guide/garbage-collection/
   - title: Using NetworkPolicy
     section:
-    - title: Example Walkthrough
+    - docs/getting-started-guides/network-policy/walkthrough.md
-      path: /docs/getting-started-guides/network-policy/walkthrough/
+    - docs/getting-started-guides/network-policy/calico.md
-    - title: Using Calico for NetworkPolicy 
+    - docs/getting-started-guides/network-policy/romana.md
-      path: /docs/getting-started-guides/network-policy/calico/
 
 - title: Batch Jobs
   section:
-  - title: Jobs
+  - docs/user-guide/jobs.md
-    path: /docs/user-guide/jobs/
+  - docs/user-guide/jobs/expansions/index.md
-  - title: Parallel Processing using Expansions
+  - docs/user-guide/jobs/work-queue-1/index.md
-    path: /docs/user-guide/jobs/expansions/
+  - docs/user-guide/jobs/work-queue-2/index.md
-  - title: Coarse Parallel Processing using a Work Queue
+  - docs/user-guide/cron-jobs.md
-    path: /docs/user-guide/jobs/work-queue-1/
-  - title: Fine Parallel Processing using a Work Queue
-    path: /docs/user-guide/jobs/work-queue-2/
 
 - title: Service Discovery and Load Balancing
   section:
-  - title: Connecting Applications with Services
+  - docs/user-guide/connecting-applications.md
-    path: /docs/user-guide/connecting-applications/
+  - docs/user-guide/services/operations.md
-  - title: Service Operations
+  - docs/user-guide/load-balancer.md
-    path: /docs/user-guide/services/operations/
+  - docs/user-guide/services-firewalls.md
-  - title: Creating an External Load Balancer
+  - docs/user-guide/federation/federated-services.md
-    path: /docs/user-guide/load-balancer/
-  - title: Configuring Your Cloud Provider's Firewalls
-    path: /docs/user-guide/services-firewalls/
-  - title: Cross-cluster Service Discovery using Federated Services
-    path: /docs/user-guide/federation/federated-services/
 
 - title: Containers and Pods
   section:
-  - title: Running Your First Containers
+  - docs/user-guide/simple-nginx.md
-    path: /docs/user-guide/simple-nginx/
+  - docs/user-guide/pods/single-container.md
-  - title: Creating Single-Container Pods
+  - docs/user-guide/pods/multi-container.md
-    path: /docs/user-guide/pods/single-container/
+  - docs/user-guide/configuring-containers.md
-  - title: Creating Multi-Container Pods
+  - docs/user-guide/production-pods.md
-    path: /docs/user-guide/pods/multi-container/
+  - docs/user-guide/containers.md
-  - title: Configuring Containers
+  - docs/user-guide/environment-guide/index.md
-    path: /docs/user-guide/configuring-containers/
+  - docs/user-guide/compute-resources.md
-  - title: Working with Containers in Production
+  - docs/user-guide/pod-states.md
-    path: /docs/user-guide/production-pods/
+  - docs/user-guide/liveness/index.md
-  - title: Commands and Capabilities
+  - docs/user-guide/container-environment.md
-    path: /docs/user-guide/containers/
+  - docs/user-guide/node-selection/index.md
-  - title: Using Environment Variables
+  - docs/user-guide/downward-api/index.md
-    path: /docs/user-guide/environment-guide/
+  - docs/user-guide/downward-api/volume/index.md
-  - title: Managing Compute Resources
+  - docs/user-guide/persistent-volumes/walkthrough.md
-    path: /docs/user-guide/compute-resources/
+  - docs/user-guide/petset/bootstrapping/index.md
-  - title: The Lifecycle of a Pod
-    path: /docs/user-guide/pod-states/
-  - title: Checking Pod Health
-    path: /docs/user-guide/liveness/
-  - title: Container Lifecycle Hooks
-    path: /docs/user-guide/container-environment/
-  - title: Assigning Pods to Nodes
-    path: /docs/user-guide/node-selection/
-  - title: Using the Downward API to Convey Pod Properties
-    path: /docs/user-guide/downward-api/
-  - title: Downward API Volumes
-    path: /docs/user-guide/downward-api/volume
-  - title: Persistent Volumes Walkthrough
-    path: /docs/user-guide/persistent-volumes/walkthrough/
-  - title: Bootstrapping Pet Sets
-    path: /docs/user-guide/petset/bootstrapping/
 
 - title: Monitoring, Logging, and Debugging Containers
   section:
-  - title: Resource Usage Monitoring
+  - docs/user-guide/monitoring.md
-    path: /docs/user-guide/monitoring/
+  - docs/getting-started-guides/logging.md
-  - title: Logging
+  - docs/getting-started-guides/logging-elasticsearch.md
-    path: /docs/getting-started-guides/logging/
+  - docs/user-guide/getting-into-containers.md
-  - title: Logging with Elasticsearch and Kibana
+  - docs/user-guide/connecting-to-applications-proxy.md
-    path: /docs/getting-started-guides/logging-elasticsearch/
+  - docs/user-guide/connecting-to-applications-port-forward.md
-  - title: Running Commands in a Container with kubectl exec
-    path: /docs/user-guide/getting-into-containers/
-  - title: Connect with Proxies
-    path: /docs/user-guide/connecting-to-applications-proxy/
-  - title: Connect with Port Forwarding
-    path: /docs/user-guide/connecting-to-applications-port-forward/
   - title: Using Explorer to Examine the Runtime Environment
     path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/explorer
 
 - title: Creating a Cluster
   section:
-  - title: Picking the Right Solution
+  - docs/getting-started-guides/index.md
-    path: /docs/getting-started-guides/
   - title: Running Kubernetes on Your Local Machine
     section:
-    - title: Running Kubernetes Locally via Minikube
+    - docs/getting-started-guides/minikube.md
-      path: /docs/getting-started-guides/minikube/
+    - docs/getting-started-guides/alternatives.md
-    - title: Deprecated Alternatives
-      path: /docs/getting-started-guides/alternatives/
   - title: Running Kubernetes on Turn-key Cloud Solutions
     section:
     - title: Running Kubernetes on Google Container Engine
       path: https://cloud.google.com/container-engine/docs/before-you-begin/
-    - title: Running Kubernetes on Google Compute Engine
+    - docs/getting-started-guides/gce.md
-      path: /docs/getting-started-guides/gce/
+    - docs/getting-started-guides/aws.md
-    - title: Running Kubernetes on AWS EC2
+    - title: Running Kubernetes on Azure Container Service
-      path: /docs/getting-started-guides/aws/
+      path: https://docs.microsoft.com/en-us/azure/container-service/container-service-kubernetes-walkthrough
-    - title: Running Kubernetes on Azure (Weave-based)
+    - docs/getting-started-guides/azure.md
-      path: /docs/getting-started-guides/coreos/azure/
+    - docs/getting-started-guides/clc.md
-    - title: Running Kubernetes on Azure (Flannel-based)
-      path: /docs/getting-started-guides/azure/
-    - title: Running Kubernetes on CenturyLink Cloud
-      path: /docs/getting-started-guides/clc/
     - title: Running Kubernetes on IBM SoftLayer
       path: https://github.com/patrocinio/kubernetes-softlayer
+    - title: Running Kubernetes on Multiple Clouds with Stackpoint.io
+      path: /docs/getting-started-guides/stackpoint/
   - title: Running Kubernetes on Custom Solutions
     section:
-    - title: Creating a Custom Cluster from Scratch
+    - docs/getting-started-guides/scratch.md
-      path: /docs/getting-started-guides/scratch/
     - title: Custom Cloud Solutions
       section:
-      - title: CoreOS on AWS or GCE
+      - docs/getting-started-guides/coreos/index.md
-        path: /docs/getting-started-guides/coreos/
+      - /docs/getting-started-guides/juju/
-      - title: Ubuntu on AWS or Joyent
+      - docs/getting-started-guides/rackspace.md
-        path: /docs/getting-started-guides/juju/
-      - title: CoreOS on Rackspace
-        path: /docs/getting-started-guides/rackspace/
     - title: On-Premise VMs
       section:
-      - title: CoreOS on Vagrant
+      - docs/getting-started-guides/coreos/index.md
-        path: /docs/getting-started-guides/coreos/
+      - docs/getting-started-guides/cloudstack.md
-      - title: Cloudstack
+      - docs/getting-started-guides/vsphere.md
-        path: /docs/getting-started-guides/cloudstack/
+      - docs/getting-started-guides/photon-controller.md
-      - title: VMware vSphere
+      - /docs/getting-started-guides/juju/
-        path: /docs/getting-started-guides/vsphere/
+      - docs/getting-started-guides/dcos.md
-      - title: VMware Photon Controller
+      - docs/getting-started-guides/libvirt-coreos.md
-        path: /docs/getting-started-guides/photon-controller/
+      - docs/getting-started-guides/ovirt.md
-      - title: Juju
+      - docs/getting-started-guides/openstack-heat.md
-        path: /docs/getting-started-guides/juju/
-      - title: DCOS
-        path: /docs/getting-started-guides/dcos/
-      - title: CoreOS on libvirt
-        path: /docs/getting-started-guides/libvirt-coreos/
-      - title: oVirt
-        path: /docs/getting-started-guides/ovirt/
-      - title: OpenStack Heat
-        path: /docs/getting-started-guides/openstack-heat/
-      - title: CoreOS on Multinode Cluster
-        path: /docs/getting-started-guides/coreos/coreos_multinode_cluster/
       - title: rkt
         section:
-        - title: Running Kubernetes with rkt
+        - docs/getting-started-guides/rkt/index.md
-          path: /docs/getting-started-guides/rkt/
+        - docs/getting-started-guides/rkt/notes.md
-        - title: Known Issues when Using rkt
+      - docs/getting-started-guides/mesos/index.md
-          path: /docs/getting-started-guides/rkt/notes/
+      - docs/getting-started-guides/mesos-docker.md
-      - title: Kubernetes on Mesos
-        path: /docs/getting-started-guides/mesos/
-      - title: Kubernetes on Mesos on Docker
-        path: /docs/getting-started-guides/mesos-docker/
     - title: Bare Metal
       section:
-      - title: Offline
+      - docs/getting-started-guides/coreos/bare_metal_offline.md
-        path: /docs/getting-started-guides/coreos/bare_metal_offline/
+      - docs/getting-started-guides/fedora/fedora_ansible_config.md
-      - title: Fedora via Ansible
+      - docs/getting-started-guides/fedora/fedora_manual_config.md
-        path: /docs/getting-started-guides/fedora/fedora_ansible_config/
+      - docs/getting-started-guides/fedora/flannel_multi_node_cluster.md
-      - title: Fedora (Single Node)
+      - docs/getting-started-guides/centos/centos_manual_config.md
-        path: /docs/getting-started-guides/fedora/fedora_manual_config/
+      - docs/getting-started-guides/coreos/index.md
-      - title: Fedora (Multi Node)
+      - /docs/getting-started-guides/ubuntu/
-        path: /docs/getting-started-guides/fedora/flannel_multi_node_cluster/
+      - docs/getting-started-guides/windows/index.md
-      - title: CentOS
+    - docs/admin/node-conformance.md
-        path: /docs/getting-started-guides/centos/centos_manual_config/
+  - docs/getting-started-guides/docker-multinode.md
-      - title: CoreOS
+  - docs/admin/cluster-large.md
-        path: /docs/getting-started-guides/coreos
+  - docs/admin/multiple-zones.md
-      - title: CoreOS with Calico
+  - docs/admin/high-availability/index.md
-        path: /docs/getting-started-guides/coreos/bare_metal_calico/
-      - title: Ubuntu
-        path: /docs/getting-started-guides/ubuntu/
-      - title: Ubuntu Nodes with Calico
-        path: /docs/getting-started-guides/ubuntu-calico/
-    - title: Validate Node Setup
-      path: /docs/admin/node-conformance
-  - title: Portable Multi-Node Cluster
-    path: /docs/getting-started-guides/docker-multinode/
-  - title: Building Large Clusters
-    path: /docs/admin/cluster-large/
-  - title: Running in Multiple Zones
-    path: /docs/admin/multiple-zones/
-  - title: Building High-Availability Clusters
-    path: /docs/admin/high-availability/
 
 - title: Administering Clusters
   section:
-  - title: Admin Guide
+  - docs/admin/index.md
-    path: /docs/admin/
+  - docs/admin/cluster-management.md
-  - title: Cluster Management Guide
+  - docs/admin/kubeadm.md
-    path: /docs/admin/cluster-management/
+  - docs/admin/addons.md
-  - title: Installing Addons
+  - docs/admin/namespaces/index.md
-    path: /docs/admin/addons/
+  - docs/admin/namespaces/walkthrough.md
-  - title: Sharing a Cluster with Namespaces
+  - docs/admin/limitrange/index.md
-    path: /docs/admin/namespaces/
+  - docs/admin/resourcequota/index.md
-  - title: Namespaces Walkthrough
+  - docs/admin/resourcequota/walkthrough.md
-    path: /docs/admin/namespaces/walkthrough/
+  - docs/admin/cluster-components.md
-  - title: Setting Pod CPU and Memory Limits
+  - docs/admin/etcd.md
-    path: /docs/admin/limitrange/
+  - docs/admin/multi-cluster.md
-  - title: Understanding Resource Quotas
-    path: /docs/admin/resourcequota/
-  - title: Applying Resource Quotas and Limits
-    path: /docs/admin/resourcequota/walkthrough/
-  - title: Kubernetes Components
-    path: /docs/admin/cluster-components/
-  - title: Configuring Kubernetes Use of etcd
-    path: /docs/admin/etcd/
-  - title: Federating Clusters
-    path: /docs/admin/federation/
-  - title: Using Multiple Clusters
-    path: /docs/admin/multi-cluster/
   - title: Changing Cluster Size
     path: https://github.com/kubernetes/kubernetes/wiki/User-FAQ#how-do-i-change-the-size-of-my-cluster/
-  - title: Configuring Multiple Schedulers
+  - docs/admin/multiple-schedulers.md
-    path: /docs/admin/multiple-schedulers/
+  - docs/admin/networking.md
-  - title: Networking in Kubernetes
+  - docs/admin/dns.md
-    path: /docs/admin/networking/
-  - title: Using DNS Pods and Services
-    path: /docs/admin/dns/
   - title: Setting Up and Configuring DNS
     path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/cluster-dns
-  - title: Master <-> Node Communication
+  - docs/admin/master-node-communication.md
-    path: /docs/admin/master-node-communication/
+  - docs/admin/network-plugins.md
-  - title: Network Plugins
+  - docs/admin/static-pods.md
-    path: /docs/admin/network-plugins/
+  - docs/admin/garbage-collection.md
-  - title: Static Pods
+  - docs/admin/out-of-resource.md
-    path: /docs/admin/static-pods/
+  - docs/admin/salt.md
-  - title: Configuring kubelet Garbage Collection
+  - docs/admin/node-problem.md
-    path: /docs/admin/garbage-collection/
+  - docs/admin/apparmor/index.md
-  - title: Configuring Out Of Resource Handling
+
-    path: /docs/admin/out-of-resource/    
+- title: Administering Federation
-  - title: Configuring Kubernetes with Salt
+  section:
-    path: /docs/admin/salt/
+  - /docs/admin/federation/kubfed/
-  - title: Monitoring Node Health
+  - docs/admin/federation/index.md
-    path: /docs/admin/node-problem/
-  - title: AppArmor
-    path: /docs/admin/apparmor/

_data/overrides.yml

@@ -8,12 +8,10 @@ overrides:
 - path: docs/admin/kube-proxy.md
 - path: docs/admin/kube-scheduler.md
 - path: docs/admin/kubelet.md
-- changedpath: docs/api-reference/extensions/v1beta1/definitions.html _includes/v1.4/extensions-v1beta1-definitions.html
+- changedpath: docs/api-reference/extensions/v1beta1/definitions.html _includes/v1.5/extensions-v1beta1-definitions.html
-- changedpath: docs/api-reference/extensions/v1beta1/operations.html _includes/v1.4/extensions-v1beta1-operations.html
+- changedpath: docs/api-reference/extensions/v1beta1/operations.html _includes/v1.5/extensions-v1beta1-operations.html
-- changedpath: docs/api-reference/v1/definitions.html _includes/v1.4/v1-definitions.html
+- changedpath: docs/api-reference/v1/definitions.html _includes/v1.5/v1-definitions.html
-- changedpath: docs/api-reference/v1/operations.html _includes/v1.4/v1-operations.html
+- changedpath: docs/api-reference/v1/operations.html _includes/v1.5/v1-operations.html
 - copypath: k8s/federation/docs/api-reference/ docs/federation/
 - copypath: k8s/cluster/saltbase/salt/fluentd-gcp/fluentd-gcp.yaml docs/getting-started-guides/fluentd-gcp.yaml
-- copypath: k8s/examples/blog-logging/counter-pod.yaml docs/getting-started-guides/counter-pod.yaml
-- copypath: k8s/examples/blog-logging/counter-pod.yaml docs/user-guide/counter-pod.yaml
 

_data/reference.yml

@@ -1,237 +1,173 @@
 bigheader: "Reference Documentation"
 abstract: "Design docs, concept definitions, and references for APIs and CLIs."
 toc:
-- title: Reference Documentation
+- docs/reference.md
-  path: /docs/reference/
 
 - title: Kubernetes API
   section:
-  - title: Kubernetes API Overview
+  - docs/api.md
-    path: /docs/api/
   - title: Accessing the API
     section:
-    - title: Overview
+    - docs/admin/accessing-the-api.md
-      path: /docs/admin/accessing-the-api/
+    - docs/admin/authentication.md
-    - title: Authenticating
+    - docs/admin/authorization.md
-      path: /docs/admin/authentication/
+    - docs/admin/admission-controllers.md
-    - title: Using Authorization Plugins
+    - docs/admin/service-accounts-admin.md
-      path: /docs/admin/authorization/
+  - docs/api-reference/v1/operations.html
-    - title: Using Admission Controllers
+  - docs/api-reference/v1/definitions.html
-      path: /docs/admin/admission-controllers/
+  - kubernetes/third_party/swagger-ui/index.md
-    - title: Managing Service Accounts
-      path: /docs/admin/service-accounts-admin/
-  - title: Kubernetes API Operations
-    path: /docs/api-reference/v1/operations/
-  - title: Kubernetes API Definitions
-    path: /docs/api-reference/v1/definitions/
-  - title: Kubernetes API Swagger Spec
-    path: /kubernetes/third_party/swagger-ui/
 
 - title: Autoscaling API
   section:
-  - title: Autoscaling API Operations
+  - docs/api-reference/autoscaling/v1/operations.html
-    path: /docs/api-reference/autoscaling/v1/operations/
+  - docs/api-reference/autoscaling/v1/definitions.html
-  - title: Autoscaling API Definitions
-    path: /docs/api-reference/autoscaling/v1/definitions/
 
 - title: Batch API
   section:
-  - title: Batch API Operations
+  - docs/api-reference/batch/v1/operations.html
-    path: /docs/api-reference/batch/v1/operations/
+  - docs/api-reference/batch/v1/definitions.html
-  - title: Batch API Definitions
+
-    path: /docs/api-reference/batch/v1/definitions/
+- title: Apps API
+  section:
+  - title: Apps API Operations
+    path: /docs/api-reference/apps/v1beta1/operations/
+  - title: Apps API Definitions
+    path: /docs/api-reference/apps/v1beta1/definitions/
 
 - title: Extensions API
   section:
-  - title: Extensions API Operations
+  - docs/api-reference/extensions/v1beta1/operations.html
-    path: /docs/api-reference/extensions/v1beta1/operations/
+  - docs/api-reference/extensions/v1beta1/definitions.html
-  - title: Extensions API Definitions
-    path: /docs/api-reference/extensions/v1beta1/definitions/    
 
 - title: kubectl CLI
   section:
-  - title: kubectl Overview
+  - docs/user-guide/kubectl-overview.md
-    path: /docs/user-guide/kubectl-overview/
+  - docs/user-guide/docker-cli-to-kubectl.md
-  - title: kubectl for Docker Users
+  - docs/user-guide/kubectl-conventions.md
-    path: /docs/user-guide/docker-cli-to-kubectl/
+  - docs/user-guide/jsonpath.md
-  - title: kubectl Usage Conventions
+  - docs/user-guide/kubectl-cheatsheet.md
-    path: /docs/user-guide/kubectl-conventions/
-  - title: JSONpath Support
-    path: /docs/user-guide/jsonpath/
-  - title: kubectl Cheat Sheet
-    path: /docs/user-guide/kubectl-cheatsheet/
   - title: kubectl Commands
     section:
-    - title: kubectl
+    - docs/user-guide/kubectl/index.md
-      path: /docs/user-guide/kubectl/
+    - docs/user-guide/kubectl/kubectl_annotate.md
-    - title: kubectl annotate
+    - docs/user-guide/kubectl/kubectl_api-versions.md
-      path: /docs/user-guide/kubectl/kubectl_annotate/
+    - docs/user-guide/kubectl/kubectl_apply.md
-    - title: kubectl api-versions
+    - docs/user-guide/kubectl/kubectl_attach.md
-      path: /docs/user-guide/kubectl/kubectl_api-versions/
+    - docs/user-guide/kubectl/kubectl_autoscale.md
-    - title: kubectl apply
+    - docs/user-guide/kubectl/kubectl_certificate.md
-      path: /docs/user-guide/kubectl/kubectl_apply/
+    - docs/user-guide/kubectl/kubectl_certificate_approve.md
-    - title: kubectl attach
+    - docs/user-guide/kubectl/kubectl_certificate_deny.md
-      path: /docs/user-guide/kubectl/kubectl_attach/
+    - docs/user-guide/kubectl/kubectl_cluster-info.md
-    - title: kubectl autoscale
+    - docs/user-guide/kubectl/kubectl_cluster-info_dump.md
-      path: /docs/user-guide/kubectl/kubectl_autoscale/
+    - docs/user-guide/kubectl/kubectl_completion.md
-    - title: kubectl cluster-info
+    - docs/user-guide/kubectl/kubectl_config.md
-      path: /docs/user-guide/kubectl/kubectl_cluster-info/
+    - docs/user-guide/kubectl/kubectl_config_current-context.md
-    - title: kubectl config
+    - docs/user-guide/kubectl/kubectl_config_delete-cluster.md
-      path: /docs/user-guide/kubectl/kubectl_config/
+    - docs/user-guide/kubectl/kubectl_config_delete-context.md
-    - title: kubectl config current-context
+    - docs/user-guide/kubectl/kubectl_config_get-clusters.md
-      path: /docs/user-guide/kubectl/kubectl_config_current-context/
+    - docs/user-guide/kubectl/kubectl_config_get-contexts.md
-    - title: kubectl config set-cluster
+    - docs/user-guide/kubectl/kubectl_config_set-cluster.md
-      path: /docs/user-guide/kubectl/kubectl_config_set-cluster/
+    - docs/user-guide/kubectl/kubectl_config_set-context.md
-    - title: kubectl config set-context
+    - docs/user-guide/kubectl/kubectl_config_set-credentials.md
-      path: /docs/user-guide/kubectl/kubectl_config_set-context/
+    - docs/user-guide/kubectl/kubectl_config_set.md
-    - title: kubectl config set-credentials
+    - docs/user-guide/kubectl/kubectl_config_unset.md
-      path: /docs/user-guide/kubectl/kubectl_config_set-credentials/
+    - docs/user-guide/kubectl/kubectl_config_use-context.md
-    - title: kubectl config set
+    - docs/user-guide/kubectl/kubectl_config_view.md
-      path: /docs/user-guide/kubectl/kubectl_config_set/
+    - docs/user-guide/kubectl/kubectl_convert.md
-    - title: kubectl config unset
+    - docs/user-guide/kubectl/kubectl_cordon.md
-      path: /docs/user-guide/kubectl/kubectl_config_unset/
+    - docs/user-guide/kubectl/kubectl_cp.md
-    - title: kubectl config use-context
+    - docs/user-guide/kubectl/kubectl_create.md
-      path: /docs/user-guide/kubectl/kubectl_config_use-context/
+    - docs/user-guide/kubectl/kubectl_create_configmap.md
-    - title: kubectl config view
+    - docs/user-guide/kubectl/kubectl_create_deployment.md
-      path: /docs/user-guide/kubectl/kubectl_config_view/
+    - docs/user-guide/kubectl/kubectl_create_namespace.md
-    - title: kubectl convert
+    - docs/user-guide/kubectl/kubectl_create_quota.md
-      path: /docs/user-guide/kubectl/kubectl_convert/
+    - docs/user-guide/kubectl/kubectl_create_secret_docker-registry.md
-    - title: kubectl cordon
+    - docs/user-guide/kubectl/kubectl_create_secret.md
-      path: /docs/user-guide/kubectl/kubectl_cordon/
+    - docs/user-guide/kubectl/kubectl_create_secret_generic.md
-    - title: kubectl create
+    - docs/user-guide/kubectl/kubectl_create_secret_tls.md
-      path: /docs/user-guide/kubectl/kubectl_create/
+    - docs/user-guide/kubectl/kubectl_create_serviceaccount.md
-    - title: kubectl create configmap
+    - docs/user-guide/kubectl/kubectl_create_service_clusterip.md
-      path: /docs/user-guide/kubectl/kubectl_create_configmap/
+    - docs/user-guide/kubectl/kubectl_create_service_loadbalancer.md
-    - title: kubectl create namespace
+    - docs/user-guide/kubectl/kubectl_create_service_nodeport.md
-      path: /docs/user-guide/kubectl/kubectl_create_namespace/
+    - docs/user-guide/kubectl/kubectl_delete.md
-    - title: kubectl create secret docker-registry
+    - docs/user-guide/kubectl/kubectl_describe.md
-      path: /docs/user-guide/kubectl/kubectl_create_secret_docker-registry/
+    - docs/user-guide/kubectl/kubectl_drain.md
-    - title: kubectl create secret
+    - docs/user-guide/kubectl/kubectl_edit.md
-      path: /docs/user-guide/kubectl/kubectl_create_secret/
+    - docs/user-guide/kubectl/kubectl_exec.md
-    - title: kubectl create secret generic
+    - docs/user-guide/kubectl/kubectl_explain.md
-      path: /docs/user-guide/kubectl/kubectl_create_secret_generic/
+    - docs/user-guide/kubectl/kubectl_expose.md
-    - title: kubectl create serviceaccount
+    - docs/user-guide/kubectl/kubectl_get.md
-      path: /docs/user-guide/kubectl/kubectl_create_serviceaccount/
+    - docs/user-guide/kubectl/kubectl_label.md
-    - title: kubectl delete
+    - docs/user-guide/kubectl/kubectl_logs.md
-      path: /docs/user-guide/kubectl/kubectl_delete/
+    - docs/user-guide/kubectl/kubectl_options.md
-    - title: kubectl describe
+    - docs/user-guide/kubectl/kubectl_patch.md
-      path: /docs/user-guide/kubectl/kubectl_describe/
+    - docs/user-guide/kubectl/kubectl_port-forward.md
-    - title: kubectl drain
+    - docs/user-guide/kubectl/kubectl_proxy.md
-      path: /docs/user-guide/kubectl/kubectl_drain/
+    - docs/user-guide/kubectl/kubectl_replace.md
-    - title: kubectl edit
+    - docs/user-guide/kubectl/kubectl_rolling-update.md
-      path: /docs/user-guide/kubectl/kubectl_edit/
+    - docs/user-guide/kubectl/kubectl_rollout.md
-    - title: kubectl exec
+    - docs/user-guide/kubectl/kubectl_rollout_history.md
-      path: /docs/user-guide/kubectl/kubectl_exec/
+    - docs/user-guide/kubectl/kubectl_rollout_pause.md
-    - title: kubectl explain
+    - docs/user-guide/kubectl/kubectl_rollout_resume.md
-      path: /docs/user-guide/kubectl/kubectl_explain/
+    - docs/user-guide/kubectl/kubectl_rollout_status.md
-    - title: kubectl expose
+    - docs/user-guide/kubectl/kubectl_rollout_undo.md
-      path: /docs/user-guide/kubectl/kubectl_expose/
+    - docs/user-guide/kubectl/kubectl_run.md
-    - title: kubectl get
+    - docs/user-guide/kubectl/kubectl_scale.md
-      path: /docs/user-guide/kubectl/kubectl_get/
+    - docs/user-guide/kubectl/kubectl_set.md
-    - title: kubectl label
+    - docs/user-guide/kubectl/kubectl_set_image.md
-      path: /docs/user-guide/kubectl/kubectl_label/
+    - docs/user-guide/kubectl/kubectl_set_resources.md
-    - title: kubectl logs
+    - docs/user-guide/kubectl/kubectl_taint.md
-      path: /docs/user-guide/kubectl/kubectl_logs/
+    - docs/user-guide/kubectl/kubectl_top.md
-    - title: kubectl patch
+    - docs/user-guide/kubectl/kubectl_top_node.md
-      path: /docs/user-guide/kubectl/kubectl_patch/
+    - docs/user-guide/kubectl/kubectl_top_pod.md
-    - title: kubectl port-forward
+    - docs/user-guide/kubectl/kubectl_uncordon.md
-      path: /docs/user-guide/kubectl/kubectl_port-forward/
+    - docs/user-guide/kubectl/kubectl_version.md
-    - title: kubectl proxy
-      path: /docs/user-guide/kubectl/kubectl_proxy/
-    - title: kubectl replace
-      path: /docs/user-guide/kubectl/kubectl_replace/
-    - title: kubectl rolling-update
-      path: /docs/user-guide/kubectl/kubectl_rolling-update/
-    - title: kubectl rollout
-      path: /docs/user-guide/kubectl/kubectl_rollout/
-    - title: kubectl rollout history
-      path: /docs/user-guide/kubectl/kubectl_rollout_history/
-    - title: kubectl rollout pause
-      path: /docs/user-guide/kubectl/kubectl_rollout_pause/
-    - title: kubectl rollout resume
-      path: /docs/user-guide/kubectl/kubectl_rollout_resume/
-    - title: kubectl rollout undo
-      path: /docs/user-guide/kubectl/kubectl_rollout_undo/
-    - title: kubectl run
-      path: /docs/user-guide/kubectl/kubectl_run/
-    - title: kubectl scale
-      path: /docs/user-guide/kubectl/kubectl_scale/
-    - title: kubectl uncordon
-      path: /docs/user-guide/kubectl/kubectl_uncordon/
-    - title: kubectl version
-      path: /docs/user-guide/kubectl/kubectl_version/
     - title: Superseded and Deprecated Commands
       section:
-      - title: kubectl namespace
+      - /docs/user-guide/kubectl/kubectl_namespace/
-        path: /docs/user-guide/kubectl/kubectl_namespace/
+      - docs/user-guide/kubectl/kubectl_stop.md
-      - title: kubectl stop
-        path: /docs/user-guide/kubectl/kubectl_stop/
 
 - title: Kubernetes Components
   section:
-  - title: kube-apiserver
+  - docs/admin/kube-apiserver.md
-    path: /docs/admin/kube-apiserver/
+  - docs/admin/kube-controller-manager.md
-  - title: kube-controller-manager
+  - docs/admin/kube-proxy.md
-    path: /docs/admin/kube-controller-manager/    
+  - docs/admin/kube-scheduler.md
-  - title: kube-proxy
-    path: /docs/admin/kube-proxy/
-  - title: kube-scheduler
-    path: /docs/admin/kube-scheduler/
   - title: kubelet
-    path: /docs/admin/kubelet/
+    section:
+    - docs/admin/kubelet.md
+    - docs/admin/master-node-communication.md
+    - docs/admin/kubelet-tls-bootstrapping.md
+    - docs/admin/kubelet-authentication-authorization.md
 
 - title: Glossary
   section:
-  - title: Annotations
+  - docs/user-guide/annotations.md
-    path: /docs/user-guide/annotations/  
+  - docs/admin/daemons.md
-  - title: Daemon Sets
+  - docs/user-guide/deployments.md
-    path: /docs/admin/daemons/
+  - docs/user-guide/horizontal-pod-autoscaling/index.md
-  - title: Deployments    
+  - docs/user-guide/images.md
-    path: /docs/user-guide/deployments/
+  - docs/user-guide/ingress.md
-  - title: Horizontal Pod Autoscaling
+  - docs/user-guide/jobs.md
-    path: /docs/user-guide/horizontal-pod-autoscaling/    
+  - docs/user-guide/labels.md
-  - title: Images
+  - docs/user-guide/identifiers.md
-    path: /docs/user-guide/images/
+  - docs/user-guide/namespaces.md
-  - title: Ingress Resources
+  - docs/user-guide/networkpolicies.md
-    path: /docs/user-guide/ingress/    
+  - docs/admin/node.md
-  - title: Jobs
+  - docs/user-guide/persistent-volumes/index.md
-    path: /docs/user-guide/jobs/    
+  - docs/user-guide/petset.md
-  - title: Labels and Selectors
+  - docs/user-guide/pods/index.md
-    path: /docs/user-guide/labels/
+  - docs/user-guide/pod-security-policy/index.md
-  - title: Names
+  - docs/user-guide/replicasets.md
-    path: /docs/user-guide/identifiers/
+  - docs/user-guide/replication-controller/index.md
-  - title: Namespaces
+  - docs/admin/resourcequota/index.md
-    path: /docs/user-guide/namespaces/
+  - docs/user-guide/cron-jobs.md
-  - title: Network Policies 
+  - docs/user-guide/secrets/index.md
-    path: /docs/user-guide/networkpolicies/    
+  - docs/user-guide/security-context.md
-  - title: Nodes
+  - docs/user-guide/services/index.md
-    path: /docs/admin/node/    
+  - docs/user-guide/service-accounts.md
-  - title: Persistent Volumes
+  - docs/user-guide/thirdpartyresources.md
-    path: /docs/user-guide/persistent-volumes/    
+  - docs/user-guide/volumes.md
-  - title: Pet Sets
-    path: /docs/user-guide/petset/    
-  - title: Pods
-    path: /docs/user-guide/pods/
-  - title: Pod Security Policies
-    path: /docs/user-guide/pod-security-policy/
-  - title: Replica Sets
-    path: /docs/user-guide/replicasets/
-  - title: Replication Controller
-    path: /docs/user-guide/replication-controller/    
-  - title: Resource Quotas
-    path: /docs/admin/resource-quota/    
-  - title: Scheduled Jobs
-    path: /docs/user-guide/scheduled-jobs/
-  - title: Secrets
-    path: /docs/user-guide/secrets/
-  - title: Security Context
-    path: /docs/user-guide/security-context/
-  - title: Services
-    path: /docs/user-guide/services/
-  - title: Service Accounts
-    path: /docs/user-guide/service-accounts/
-  - title: Volumes
-    path: /docs/user-guide/volumes/
 
 - title: Kubernetes Design Docs
   section:
@@ -241,8 +177,7 @@ toc:
     path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/
   - title: Kubernetes Identity and Access Management
     path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/access.md
-  - title: Kubernetes OpenVSwitch GRE/VxLAN networking
+  - docs/admin/ovs-networking.md
-    path: /docs/admin/ovs-networking/    
   - title: Security Contexts
     path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/security_context.md
   - title: Security in Kubernetes
@@ -250,23 +185,18 @@ toc:
 
 - title: Federation
   section:
-  - title: Federation User Guide
+  - docs/user-guide/federation/index.md
-    path: /docs/user-guide/federation/
+  - docs/user-guide/federation/configmap.md
-  - title: Federated Events
+  - docs/user-guide/federation/daemonsets.md
-    path: /docs/user-guide/federation/events/
+  - docs/user-guide/federation/deployment.md
-  - title: Federated Ingress
+  - docs/user-guide/federation/events.md
-    path: /docs/user-guide/federation/federated-ingress/
+  - docs/user-guide/federation/federated-ingress.md
-  - title: Federated Namespaces
+  - docs/user-guide/federation/namespaces.md
-    path: /docs/user-guide/federation/namespaces/
+  - docs/user-guide/federation/replicasets.md
-  - title: Federated ReplicaSets
+  - docs/user-guide/federation/secrets.md
-    path: /docs/user-guide/federation/replicasets/
+  - docs/federation/api-reference/README.md
-  - title: Federated Secrets
-    path: /docs/user-guide/federation/secrets/
-  - title: Federation API
-    path: /docs/federation/api-reference/README/
   - title: Federation Components
     section:
-    - title: federation-apiserver
+    - docs/admin/federation-apiserver.md
-      path: /docs/admin/federation-apiserver.md
     - title : federation-controller-mananger
-      path: /docs/admin/federation-controller-manager.md
+      path: /docs/admin/federation-controller-manager

_data/samples.yml

@@ -1,8 +1,7 @@
 bigheader: "Samples"
 abstract: "A collection of example applications that show how to use Kubernetes."
 toc:
-- title: Samples
+- docs/samples.md
-  path: /docs/samples/
 
 - title: Storage / Database / KV
   section:
@@ -12,6 +11,8 @@ toc:
     path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/rbd/
   - title: CephFS
     path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/cephfs/
+  - title: CockroachDB
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.4/examples/cockroachdb/
   - title: GlusterFS
     path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/glusterfs/
   - title: Hazelcast
@@ -65,8 +66,7 @@ toc:
     path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/guestbook-go/
   - title: GuestBook - PHP Server
     path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/guestbook/
-  - title: MEAN stack on Google Cloud Platform
+  - docs/getting-started-guides/meanstack.md
-    path: /docs/getting-started-guides/meanstack/
   - title: MySQL + Wordpress
     path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/mysql-wordpress-pd/
   - title: MySQL + Phabricator Server

_data/support.yml

@@ -1,28 +1,25 @@
 bigheader: "Support"
 abstract: "Troubleshooting resources, frequently asked questions, and community support channels."
 toc:
-- title: Support
+- docs/troubleshooting.md
-  path: /docs/troubleshooting/
 
 - title: Contributing to the Kubernetes Docs
   section:
-  - title: Using Page Templates
+  - editdocs.md
-    path: /docs/contribute/page-templates/
+  - docs/contribute/create-pull-request.md
+  - docs/contribute/write-new-topic.md
+  - docs/contribute/stage-documentation-changes.md
+  - docs/contribute/page-templates.md
+  - docs/contribute/style-guide.md
 
 - title: Troubleshooting
   section:
-  - title: Debugging Pods and Replication Controllers
+  - docs/user-guide/debugging-pods-and-replication-controllers.md
-    path: /docs/user-guide/debugging-pods-and-replication-controllers/
+  - docs/user-guide/introspection-and-debugging.md
-  - title: Application Introspection and Debugging
+  - docs/user-guide/logging.md
-    path: /docs/user-guide/introspection-and-debugging/
+  - docs/user-guide/application-troubleshooting.md
-  - title: Retrieving Logs
+  - docs/admin/cluster-troubleshooting.md
-    path: /docs/user-guide/logging/
+  - docs/user-guide/debugging-services.md
-  - title: Troubleshooting Applications
-    path: /docs/user-guide/application-troubleshooting/
-  - title: Troubleshooting Clusters
-    path: /docs/admin/cluster-troubleshooting/
-  - title: Debugging Services
-    path: /docs/user-guide/debugging-services/
 
 - title: Frequently Asked Questions
   section:
@@ -37,13 +34,8 @@ toc:
   section:
   - title: Kubernetes Issue Tracker on GitHub
     path: https://github.com/kubernetes/kubernetes/issues/
-  - title: Report a Security Vulnerability
+  - docs/reporting-security-issues.md
-    path: /docs/reporting-security-issues/
   - title: Release Notes
     path: https://github.com/kubernetes/kubernetes/releases/
   - title: Release Roadmap
     path: https://github.com/kubernetes/kubernetes/milestones/
-  - title: Contributing to Kubernetes Documentation
-    path: /editdocs/
-  - title: New Template Instructions
-    path: /docs/templatedemos/

_data/tasks.yml

@@ -1,17 +1,44 @@
 bigheader: "Tasks"
+abstract: "Step-by-step instructions for performing operations with Kuberentes."
 toc:
-- title: Tasks
+- docs/tasks/index.md
-  path: /docs/tasks/
+
+- title: Configuring Pods and Containers
+  section:
+  - docs/tasks/configure-pod-container/define-environment-variable-container.md
+  - docs/tasks/configure-pod-container/define-command-argument-container.md
+  - docs/tasks/configure-pod-container/assign-cpu-ram-container.md
+  - docs/tasks/configure-pod-container/configure-volume-storage.md
+  - docs/tasks/configure-pod-container/distribute-credentials-secure.md
+
 - title: Accessing Applications in a Cluster
   section:
-  - title: Using Port Forwarding to Access Applications in a Cluster
+  - docs/tasks/access-application-cluster/port-forward-access-application-cluster.md
-    path: /docs/tasks/access-application-cluster/port-forward-access-application-cluster/
+
+- title: Debugging Applications in a Cluster
+  section:
+  - docs/tasks/debug-application-cluster/determine-reason-pod-failure.md
+
 - title: Accessing the Kubernetes API
   section:
-  - title: Using an HTTP Proxy to Access the Kubernetes API
+  - docs/tasks/access-kubernetes-api/http-proxy-access-api.md
-    path: /docs/tasks/access-kubernetes-api/http-proxy-access-api/
+
 - title: Administering a Cluster
   section:
-  - title: Assigning Pods to Nodes
+  - docs/tasks/administer-cluster/assign-pods-nodes.md
-    path: /docs/tasks/administer-cluster/assign-pods-nodes/
 
+  - docs/tasks/administer-cluster/dns-horizontal-autoscaling.md
+  - docs/tasks/administer-cluster/safely-drain-node.md
+
+- title: Managing Stateful Applications
+  section:
+  - docs/tasks/manage-stateful-set/upgrade-pet-set-to-stateful-set.md
+  - docs/tasks/manage-stateful-set/scale-stateful-set.md
+  - docs/tasks/manage-stateful-set/deleting-a-statefulset.md
+  - docs/tasks/manage-stateful-set/debugging-a-statefulset.md
+  - docs/tasks/manage-stateful-set/delete-pods.md
+
+- title: Troubleshooting
+  section:
+  - docs/tasks/troubleshoot/debug-init-containers.md
+  - /docs/tasks/administer-cluster/access-control-identity-management/

_data/tools.yml

@@ -0,0 +1,21 @@
+bigheader: "Tools"
+abstract: "Tools to help you use and enhance Kubernetes."
+toc:
+- docs/tools/index.md
+
+- title: Native Tools
+  section:
+  - title: Kubectl
+    path: /docs/user-guide/kubectl/
+  - title: Kubefed
+    path: /docs/admin/federation/kubefed/
+  - title: Kubernetes Dashboard
+    path: /docs/user-guide/ui/
+  
+- title: Third-Party Tools
+  section:
+  - title: Helm
+    path: https://github.com/kubernetes/helm
+  - title: Kompose
+    path: https://github.com/kubernetes-incubator/kompose
+  

_data/tutorials.yml

@@ -1,60 +1,43 @@
 bigheader: "Tutorials"
+abstract: "Detailed walkthroughs of common Kubernetes operations and workflows."
 toc:
-- title: Tutorials
+- docs/tutorials/index.md
-  path: /docs/tutorials/
+- title: Kubernetes Basics
-- title: Getting Started
   section:
+  - docs/tutorials/kubernetes-basics/index.html
   - title: 1. Create a Cluster
     section:
-    - title: Creating a Cluster
+    - docs/tutorials/kubernetes-basics/cluster-intro.html
-      path: /docs/tutorials/getting-started/create-cluster/
+    - docs/tutorials/kubernetes-basics/cluster-interactive.html
-    - title: Using Minikube to Create a Cluster
-      path: /docs/tutorials/getting-started/cluster-intro/
-    - title: Interactive Tutorial - Creating a Cluster
-      path: /docs/tutorials/getting-started/cluster-interactive/
   - title: 2. Deploy an App
     section:
-    - title: Deploying an App
+    - docs/tutorials/kubernetes-basics/deploy-intro.html
-      path: /docs/tutorials/getting-started/deploy-app/
+    - docs/tutorials/kubernetes-basics/deploy-interactive.html
-    - title: Using kubectl to Create a Deployment
-      path: /docs/tutorials/getting-started/deploy-intro/
-    - title: Interactive Tutorial - Deploying an App
-      path: /docs/tutorials/getting-started/deploy-interactive/
   - title: 3. Explore Your App
     section:
-    - title: Exploring Your App
+    - docs/tutorials/kubernetes-basics/explore-intro.html
-      path: /docs/tutorials/getting-started/explore-app/
+    - docs/tutorials/kubernetes-basics/explore-interactive.html
-    - title: Viewing Pods and Nodes
-      path: /docs/tutorials/getting-started/explore-intro/
-    - title: Interactive Tutorial - Exploring Your App
-      path: /docs/tutorials/getting-started/explore-interactive/
   - title: 4. Expose Your App Publicly
     section:
-    - title: Exposing Your App Publicly
+    - docs/tutorials/kubernetes-basics/expose-intro.html
-      path: /docs/tutorials/getting-started/expose-app/
+    - docs/tutorials/kubernetes-basics/expose-interactive.html
-    - title: Using a Service to Expose Your App
-      path: /docs/tutorials/getting-started/expose-intro/
-    - title: Interactive Tutorial - Exposing Your App
-      path: /docs/tutorials/getting-started/expose-interactive/
   - title: 5. Scale Your App
     section:
-    - title: Scaling Your App
+    - docs/tutorials/kubernetes-basics/scale-intro.html
-      path: /docs/tutorials/getting-started/scale-app/
+    - docs/tutorials/kubernetes-basics/scale-interactive.html
-    - title: Running Multiple Instances of Your App
-      path: /docs/tutorials/getting-started/scale-intro/
-    - title: Interactive Tutorial - Scaling Your App
-      path: /docs/tutorials/getting-started/scale-interactive/
   - title: 6. Update Your App
     section:
-    - title: Updating Your App
+    - docs/tutorials/kubernetes-basics/update-intro.html
-      path: /docs/tutorials/getting-started/update-app/
+    - docs/tutorials/kubernetes-basics/update-interactive.html
-    - title: Performing a Rolling Update
-      path: /docs/tutorials/getting-started/update-intro/
-    - title: Interactive Tutorial - Updating Your App
-      path: /docs/tutorials/getting-started/update-interactive/
 - title: Stateless Applications
   section:
-  - title: Running a Stateless Application Using a Deployment
+  - docs/tutorials/stateless-application/hello-minikube.md
-    path: /docs/tutorials/stateless-application/run-stateless-application-deployment/
+  - docs/tutorials/stateless-application/run-stateless-application-deployment.md
-  - title: Using a Service to Access an Application in a Cluster
+  - docs/tutorials/stateless-application/expose-external-ip-address-service.md
-    path: /docs/tutorials/stateless-application/expose-external-ip-address-service/
+  - docs/tutorials/stateless-application/expose-external-ip-address.md
+- title: Stateful Applications
+  section:
+  - docs/tutorials/stateful-application/basic-stateful-set.md
+  - docs/tutorials/stateful-application/run-stateful-application.md
+  - docs/tutorials/stateful-application/run-replicated-stateful-application.md
+  - docs/tutorials/stateful-application/zookeeper.md

_includes/default-storage-class-prereqs.md

@@ -0,0 +1,6 @@
+You need to either have a dynamic PersistentVolume provisioner with a default
+[StorageClass](/docs/user-guide/persistent-volumes/#storageclasses),
+or [statically provision PersistentVolumes](/docs/user-guide/persistent-volumes/#provisioning)
+yourself to satisfy the [PersistentVolumeClaims](/docs/user-guide/persistent-volumes/#persistentvolumeclaims)
+used here.
+

_includes/footer.html

@@ -4,6 +4,7 @@
 			<a href="/docs/hellonode/">Get Started</a>
 			<a href="/docs/">Documentation</a>
 			<a href="http://blog.kubernetes.io/">Blog</a>
+			<a href="/partners/">Partners</a>
 			<a href="/community/">Community</a>
 			<a href="/case-studies/">Case Studies</a>
 		</nav>
@@ -19,8 +20,15 @@
 				<a href="https://calendar.google.com/calendar/embed?src=nt2tcnbtbied3l6gi2h29slvc0%40group.calendar.google.com" class="calendar"><span>Events Calendar</span></a>
 			</div>
 			<div>
+				<a href="//get.k8s.io" class="button">Download K8s</a>
+				<a href="https://github.com/kubernetes/kubernetes" class="button">Contribute to the K8s codebase</a>
 			</div>
 		</div>
-		<div id="miceType" class="center">&copy; {{ 'now' | date: "%Y" }} Kubernetes</div>
+		<div id="miceType" class="center">
+			&copy; {{ 'now' | date: "%Y" }} The Kubernetes Authors | Documentation Distributed under <a href="https://github.com/kubernetes/kubernetes.github.io/blob/master/LICENSE" class="light-text">CC BY 4.0</a>
+		</div>
+		<div id="miceType" class="center">
+			Copyright &copy; {{ 'now' | date: "%Y" }} The Linux Foundation&reg;. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page: <a href="https://www.linuxfoundation.org/trademark-usage" class="light-text">https://www.linuxfoundation.org/trademark-usage</a>
+		</div>
 	</main>
 </footer>

_includes/head-header.html

@@ -1,8 +1,6 @@
-{% if page.title %}{% assign title=page.title %}{% endif %}
 <head>
 	<meta charset="utf-8">
 	<meta name="viewport" content="width=device-width, initial-scale=1">
-	<link rel="canonical" href="http://kubernetes.io{{page.url}}" />
 	<link rel="shortcut icon" type="image/png" href="/images/favicon.png">
 	<link href='https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900,900italic' rel='stylesheet' type='text/css'>
 	<link rel="stylesheet" href='https://fonts.googleapis.com/css?family=Roboto+Mono' type='text/css'>
@@ -13,15 +11,24 @@
         <script src="/js/jquery-ui.min.js"></script>
 	<script src="/js/script.js"></script>
         <script src="/js/sweetalert.min.js"></script>
-	<title>Kubernetes - {{ title }}</title>
+	<script src="/js/bootstrap.min.js"></script>
+	{% seo %}
 </head>
 <body>
 <div id="cellophane" onclick="kub.toggleMenu()"></div>
 <header>
 	<a href="/" class="logo"></a>
+	
 	<div class="nav-buttons" data-auto-burger="primary">
-		<a href="/docs/" class="button" id="viewDocs" data-auto-burger-exclude>View Documentation</a>
+		<ul class="global-nav">
-		<a href="/docs/hellonode/" class="button" id="tryKubernetes" data-auto-burger-exclude>Try Kubernetes</a>
+			<li><a href="/docs/">Documentation</a></li>
+			<li><a href="http://blog.kubernetes.io/">Blog</a></li>
+			<li><a href="/partners/">Partners</a></li>
+			<li><a href="/community/">Community</a></li>
+			<li><a href="/case-studies/">Case Studies</a></li>
+		</ul>
+		<!-- <a href="/docs/" class="button" id="viewDocs" data-auto-burger-exclude>View Documentation</a> -->
+		<a href="/docs/tutorials/kubernetes-basics/" class="button" id="tryKubernetes" data-auto-burger-exclude>Try Kubernetes</a>
 		<button id="hamburger" onclick="kub.toggleMenu()" data-auto-burger-exclude><div></div></button>
 	</div>
 

_includes/partner-script.js

@@ -0,0 +1,327 @@
+;(function () {
+	var partners = [
+		{
+			type: 0,
+			name: 'CoreOS',
+			logo: 'core_os',
+			link: 'https://tectonic.com/',
+			blurb: 'Tectonic is the enterprise-ready Kubernetes product, by CoreOS. It adds key features to allow you to manage, update, and control clusters in production.'
+		},
+		{
+			type: 0,
+			name: 'Deis',
+			logo: 'deis',
+			link: 'https://deis.com',
+			blurb: 'Deis the creators of Helm, Workflow, and Steward, helps developers and operators build, deploy, manage and scale their applications on top of Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'StackPointCloud',
+			logo: 'stackpoint',
+			link: 'https://stackpoint.io',
+			blurb: 'StackPointCloud builds Stackpoint.io, the universal control plane for Kubernetes Anywhere -- compose and build your own infrastructure as easily as a DigitalOcean droplet at any public cloud provider.'
+		},
+		{
+			type: 0,
+			name: 'Sysdig Cloud',
+			logo: 'sys_dig',
+			link: 'https://sysdig.com/blog/monitoring-kubernetes-with-sysdig-cloud/',
+			blurb: 'Container native monitoring with deep support for Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'Puppet',
+			logo: 'puppet',
+			link: 'https://puppet.com/blog/managing-kubernetes-configuration-puppet',
+			blurb: 'The Puppet module for Kubernetes makes it easy to manage Pods, Replication Controllers, Services and more in Kubernetes, and to build domain-specific interfaces to one\'s Kubernetes configuration.'
+		},
+		{
+			type: 0,
+			name: 'Citrix',
+			logo: 'citrix',
+			link: 'http://wercker.com/workflows/partners/kubernetes/',
+			blurb: 'Netscaler CPX gives app developers all the features they need to load balance their microservices and containerized apps with Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'Cockroach Labs',
+			logo: 'cockroach_labs',
+			link: 'https://www.cockroachlabs.com/blog/running-cockroachdb-on-kubernetes/',
+			blurb: 'CockroachDB is a distributed SQL database whose built-in replication and survivability model pair with Kubernetes to truly make data easy.'
+		},
+		{
+			type: 0,
+			name: 'Skippbox',
+			logo: 'skippbox',
+			link: 'http://www.skippbox.com/tag/products/',
+			blurb: 'Creator of Cabin the first mobile application for Kubernetes, and kompose. Skippbox’s solutions distill all the power of k8s in simple easy to use interfaces.'
+		},
+		{
+			type: 0,
+			name: 'Weave Works',
+			logo: 'weave_works',
+			link: ' https://weave.works/kubernetes',
+			blurb: 'Weaveworks enables Developers and Dev/Ops teams to easily connect, deploy, secure, manage, and troubleshoot microservices in Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'Wercker',
+			logo: 'wercker',
+			link: 'http://wercker.com/workflows/partners/kubernetes/',
+			blurb: 'Wercker automates your build, test and deploy pipelines for launching containers and triggering rolling updates on your Kubernetes cluster. '
+		},
+		{
+			type: 0,
+			name: 'Rancher',
+			logo: 'rancher',
+			link: 'http://rancher.com/kubernetes/',
+			blurb: 'Rancher is an open-source, production-ready container management platform that makes it easy to deploy and leverage Kubernetes in the enterprise.'
+		},
+		{
+			type: 0,
+			name: 'Red Hat',
+			logo: 'redhat',
+			link: 'https://www.openshift.com/',
+			blurb: 'Leverage an enterprise Kubernetes platform to orchestrate complex, multi-container apps.'
+		},
+		{
+			type: 0,
+			name: 'Intel',
+			logo: 'intel',
+			link: 'https://tectonic.com/press/intel-coreos-collaborate-on-openstack-with-kubernetes.html',
+			blurb: 'Powering the GIFEE (Google’s Infrastructure for Everyone Else), to run OpenStack deployments on Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'ElasticKube',
+			logo: 'elastickube',
+			link: 'https://www.ctl.io/elastickube-kubernetes/',
+			blurb: 'Self-service container management for Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'Platform9',
+			logo: 'platform9',
+			link: 'https://platform9.com/products/kubernetes/',
+			blurb: 'Platform9 is the open source-as-a-service company that takes all of the goodness of Kubernetes and delivers it as a managed service.'
+		},
+		{
+			type: 0,
+			name: 'Datadog',
+			logo: 'datadog',
+			link: 'http://docs.datadoghq.com/integrations/kubernetes/',
+			blurb: 'Full-stack observability for dynamic infrastructure & applications. Includes precision alerting, analytics and deep Kubernetes integrations. '
+		},
+		{
+			type: 0,
+			name: 'AppFormix',
+			logo: 'appformix',
+			link: 'http://www.appformix.com/solutions/appformix-for-kubernetes/',
+			blurb: 'AppFormix is a cloud infrastructure performance optimization service helping enterprise operators streamline their cloud operations on any Kubernetes cloud. '
+		},
+		{
+			type: 0,
+			name: 'Crunchy',
+			logo: 'crunchy',
+			link: 'http://info.crunchydata.com/blog/advanced-crunchy-containers-for-postgresql',
+			blurb: 'Crunchy PostgreSQL Container Suite is a set of containers for managing PostgreSQL with DBA microservices leveraging Kubernetes and Helm.'
+		},
+		{
+			type: 0,
+			name: 'Aqua',
+			logo: 'aqua',
+			link: 'http://blog.aquasec.com/security-best-practices-for-kubernetes-deployment',
+			blurb: 'Deep, automated security for your containers running on Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'Canonical',
+			logo: 'canonical',
+			link: 'https://jujucharms.com/canonical-kubernetes/',
+			blurb: 'The Canonical Distribution of Kubernetes enables you to operate Kubernetes clusters on demand on any major public cloud and private	infrastructure.'
+		},
+		{
+			type: 0,
+			name: 'Distelli',
+			logo: 'distelli',
+			link: 'https://www.distelli.com/',
+			blurb: 'Pipelines from your source repositories to your Kubernetes Clusters on any cloud.'
+		},
+		{
+			type: 0,
+			name: 'Nuage networks',
+			logo: 'nuagenetworks',
+			link: 'https://github.com/nuagenetworks/nuage-kubernetes',
+			blurb: 'The Nuage SDN platform provides policy-based networking between Kubernetes Pods and non-Kubernetes environments with visibility and security monitoring.'
+		},
+		{
+			type: 0,
+			name: 'Sematext',
+			logo: 'sematext',
+			link: 'https://sematext.com/kubernetes/',
+			blurb: 'Logging & Monitoring: Automatic collection and processing of Metrics, Events and Logs for auto-discovered pods and Kubernetes nodes.'
+		},
+		{
+			type: 0,
+			name: 'Diamanti',
+			logo: 'diamanti',
+			link: 'https://www.diamanti.com/products/',
+			blurb: 'Diamanti deploys containers with guaranteed performance using Kubernetes in the first hyperconverged appliance purpose built for containerized applications.'
+		},
+		{
+			type: 0,
+			name: 'Apprenda',
+			logo: 'apprenda',
+			link: 'https://apprenda.com/kubernetes-support/',
+			blurb: 'Apprenda creates and supports modern, enterprise-ready application platforms for both cloud native and traditional application workloads.'
+		},
+		{
+			type: 0,
+			name: 'Aporeto',
+			logo: 'aporeto',
+			link: 'https://aporeto.com/trireme',
+			blurb: 'Aporeto makes cloud-native applications secure by default without impacting developer velocity and works at any scale, on any cloud.'
+		},
+		{
+  		type: 0,
+ 			name: 'Giant Swarm',
+ 			logo: 'giant_swarm',
+ 			link: 'https://giantswarm.io',
+ 			blurb: 'Giant Swarm provides fully-managed Kubernetes Clusters in your location of choice, so you can focus on your product.'
+ 		},
+		{
+ 			type: 0,
+ 			name: 'Mirantis',
+ 			logo: 'mirantis',
+ 			link: 'https://content.mirantis.com/Containerizing-OpenStack-on-Kubernetes-Video-Landing-Page.html',
+ 			blurb: 'Mirantis builds and manages private clouds with open source software such as OpenStack, deployed as containers orchestrated by Kubernetes.'
+ 		},
+		{
+ 			type: 0,
+ 			name: 'Kubernetic',
+ 			logo: 'kubernetic',
+ 			link: 'https://kubernetic.com/',
+ 			blurb: 'Kubernetic is a Kubernetes Desktop client that simplifies and democratizes cluster management for DevOps.'
+ 		},
+		{
+			type: 1,
+			name: 'Apprenda',
+			logo: 'apprenda',
+			link: 'https://apprenda.com/kubernetes-support/',
+			blurb: 'Apprenda offers flexible and wide range of support plans for pure play Kubernetes on your choice of infrastructure, cloud provider and operating system.'
+		},
+		{
+			type: 1,
+			name: 'Reactive Ops',
+			logo: 'reactive_ops',
+			link: 'https://www.reactiveops.com/kubernetes/',
+			blurb: 'ReactiveOps has written automation on best practices for infrastructure as code on GCP & AWS using Kubernetes, helping you build and maintain a world-class infrastructure at a fraction of the price of an internal hire.'
+		},
+		{
+			type: 1,
+			name: 'Livewyer',
+			logo: 'livewyer',
+			link: 'https://livewyer.io/services/kubernetes-experts/',
+			blurb: 'Kubernetes experts that on-board applications and empower IT teams to get the most out of containerised technology.'
+		},
+		{
+			type: 1,
+			name: 'Deis',
+			logo: 'deis',
+			link: 'https://deis.com/services/',
+			blurb: 'Deis provides professional services and 24x7 operational support for any Kubernetes cluster managed by our global cluster operations team.'
+		},
+		{
+			type: 1,
+			name: 'StackPointCloud',
+			logo: 'stackpoint',
+			link: 'https://stackpoint.io',
+			blurb: 'StackPointCloud offers a wide range of support plans for managed Kubernetes clusters built through its universal control plane for Kubernetes Anywhere.'
+		},
+		{
+			type: 1,
+			name: 'Samsung SDS',
+			logo: 'samsung_sds',
+			link: 'http://www.samsungsdsa.com/cloud-infrastructure_kubernetes',
+			blurb: 'Samsung SDS’s Cloud Native Computing Team offers expert consulting across the range of technical aspects involved in building services targeted at a Kubernetes cluster.'
+		},
+		{
+			type: 1,
+			name: 'Container Solutions',
+			logo: 'container_solutions',
+			link: 'http://container-solutions.com/resources/kubernetes/',
+			blurb: 'Container Solutions is a premium software consultancy that focuses on programmable infrastructure, offering our expertise in software development, strategy and operations to help you innovate at speed and scale.'
+		},
+		{
+			type: 1,
+			name: 'Jetstack',
+			logo: 'jetstack',
+			link: 'https://www.jetstack.io/',
+			blurb: 'Jetstack is an organisation focused entirely on Kubernetes. They will help you to get the most out of Kubernetes through expert professional services and open source tooling. Get in touch, and accelerate your project.'
+		},
+		{
+			type: 0,
+			name: 'Tigera',
+			logo: 'tigera',
+			link: 'http://docs.projectcalico.org/v1.5/getting-started/kubernetes/',
+			blurb: 'Tigera builds high performance, policy driven, cloud native networking solutions for Kubernetes.'
+		},
+		{
+			type: 1,
+			name: 'Skippbox',
+			logo: 'skippbox',
+			link: 'http://www.skippbox.com/services/',
+			blurb: 'Skippbox brings its Kubernetes expertise to help companies embrace Kubernetes on their way to digital transformation. Skippbox offers both professional services and expert training.'
+		},
+		{
+ 			type: 1,
+ 			name: 'Harbur',
+ 			logo: 'harbur',
+ 			link: 'https://harbur.io/',
+ 			blurb: 'Based in Barcelona, Harbur is a consulting firm that helps companies deploy self-healing solutions empowered by Container technologies'
+  	},
+		{
+ 			type: 1,
+ 			name: 'Endocode',
+ 			logo: 'endocode',
+ 			link: 'https://endocode.com/kubernetes/',
+ 			blurb: 'Endocode practices and teaches the open source way. Kernel to cluster - Dev to Ops. We offer Kubernetes trainings, services and support.'
+  	}
+	]
+
+	var isvContainer = document.getElementById('isvContainer')
+	var servContainer = document.getElementById('servContainer')
+
+	var sorted = partners.sort(function (a, b) {
+		if (a.name > b.name) return 1
+		if (a.name < b.name) return -1
+		return 0
+	})
+
+	sorted.forEach(function (obj) {
+		var box = document.createElement('div')
+		box.className = 'partner-box'
+
+		var img = document.createElement('img')
+		img.src = '/images/square-logos/' + obj.logo + '.png'
+
+		var div = document.createElement('div')
+
+		var p = document.createElement('p')
+		p.textContent = obj.blurb
+
+		var link = document.createElement('a')
+		link.href = obj.link
+		link.target = '_blank'
+		link.textContent = 'Learn more'
+
+		div.appendChild(p)
+		div.appendChild(link)
+
+		box.appendChild(img)
+		box.appendChild(div)
+
+		var container = obj.type ? servContainer : isvContainer
+		container.appendChild(box)
+	})
+})();

_includes/partner-style.css

@@ -0,0 +1,94 @@
+h5 {
+	font-size: 18px;
+	line-height: 1.5em;
+	margin-bottom: 2em;
+}
+
+#usersGrid a {
+	display: inline-block;
+	background-color: #f9f9f9;
+}
+
+#isvContainer, #servContainer {
+	position: relative;
+	width: 100%;
+	display: flex;
+	justify-content: space-between;
+	flex-wrap: wrap;
+}
+
+#isvContainer {
+	margin-bottom: 80px;
+}
+
+.partner-box {
+	position: relative;
+	width: 47%;
+	max-width: 48%;
+	min-width: 48%;
+	margin-bottom: 20px;
+	padding: 20px;
+	flex: 1;
+	display: flex;
+	justify-content: space-between;
+	align-items: flex-start;
+}
+
+.partner-box img {
+	background-color: #f9f9f9;
+}
+
+.partner-box > div {
+	margin-left: 30px;
+}
+
+.partner-box a {
+	color: #3576E3;
+}
+
+@media screen and (max-width: 1024px) {
+	.partner-box {
+		flex-direction: column;
+		justify-content: flex-start;
+	}
+
+	.partner-box > div {
+		margin: 20px 0 0;
+	}
+}
+
+@media screen and (max-width: 568px) {
+	#isvContainer, #servContainer {
+		justify-content: center;
+	}
+
+	.partner-box {
+		flex-direction: column;
+		justify-content: flex-start;
+		width: 100%;
+		max-width: 100%;
+		min-width: 100%;
+	}
+
+	.partner-box > div {
+		margin: 20px 0 0;
+	}
+}
+
+@media screen and (max-width: 568px) {
+	#isvContainer, #servContainer {
+		justify-content: center;
+	}
+
+	.partner-box {
+		flex-direction: column;
+		justify-content: flex-start;
+		width: 100%;
+		max-width: 100%;
+		min-width: 100%;
+	}
+
+	.partner-box > div {
+		margin: 20px 0 0;
+	}
+}

_includes/task-tutorial-prereqs.md

@@ -0,0 +1,4 @@
+You need to have a Kubernetes cluster, and the kubectl command-line tool must
+be configured to communicate with your cluster. If you do not already have a
+cluster, you can create one by using
+[Minikube](/docs/getting-started-guides/minikube).

_includes/tocsearch.html

@@ -1 +1,15 @@
-{% for item in tree %}{% if item.section %}{% assign tree = item.section %}{% include tocsearch.html %}{% else %}{% if item.path == page.url %}{% assign foundTOC = thistoc %}{% assign title = item.title %}{% break %}{% endif %}{% endif %}{% endfor %}
+{% capture whitespace %}
+  {% for item in include.tree %}
+    {% if found_toc %}
+      {% break %}
+    {% endif %}
+    {% if item.section %}
+      {% include tocsearch.html tree=item.section toc=include.toc %}
+    {% else %}
+      {% if item == page.path %}
+        {% assign found_toc = include.toc %}
+        {% break %}
+      {% endif %}
+    {% endif %}
+  {% endfor %}
+{% endcapture %}

_includes/tree.html

@@ -1,6 +1,25 @@
-{% for item in tree %}{% if item.section %}
+{% for item in include.tree %}
-<div class="item" data-title="{{ item.title }}">
+  {% if item.section %}
-  <div class="container">{% assign tree = item.section %}{% include tree.html %}
+    <div class="item" data-title="{{ item.title }}">
-  </div>
+      <div class="container">
-</div>{% else %}{% assign prefix = item.path | slice: 0, 4 %}{% if prefix == "http" %}{% assign target=" target='_blank'" %}{% else %}{% assign target="" %}{% endif %}
+        {% include_cached tree.html tree=item.section %}
-    <a class="item" data-title="{{ item.title }}" href="{{ item.path }}"{{ target }}></a>{% endif %}{% endfor %}
+      </div>
+    </div>
+  {% else %}
+
+    {% capture whitespace %}
+      {% if item.path %}
+        {% assign path   = item.path %}
+        {% assign title  = item.title %}
+      {% else %}
+        {% assign page  = site.pages | where: "path", item | first %}
+        {% assign title = page.title %}
+        {% assign path  = page.url %}
+      {% endif %}
+    {% endcapture %}
+
+    {% if path %}
+      <a class="item" data-title="{{ title }}" href="{{ path }}"></a>
+    {% endif %}
+  {% endif %}
+{% endfor %}

_includes/v1.3/extensions-v1beta1-definitions.html

@@ -2079,7 +2079,7 @@ Populated by the system when a graceful deletion is requested. Read-only. More i
 <div class="sect2">
 <h3 id="_v1_flexvolumesource">v1.FlexVolumeSource</h3>
 <div class="paragraph">
-<p>FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p>
+<p>FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p>
 </div>
 <table class="tableblock frame-all grid-all" style="width:100%; ">
 <colgroup>
@@ -2535,7 +2535,7 @@ Populated by the system when a graceful deletion is requested. Read-only. More i
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">flexVolume</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_flexvolumesource">v1.FlexVolumeSource</a></p></td>
 <td class="tableblock halign-left valign-top"></td>
@@ -5867,7 +5867,7 @@ Both these may change in the future. Incoming requests are matched against the h
 <tbody>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">path</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Path is a extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Path is an extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>

_includes/v1.3/extensions-v1beta1-operations.html

@@ -5578,7 +5578,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_a_ingress">create a Ingress</h3>
+<h3 id="_create_a_ingress">create an Ingress</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /apis/extensions/v1beta1/namespaces/{namespace}/ingresses</pre>
@@ -5959,7 +5959,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_delete_a_ingress">delete a Ingress</h3>
+<h3 id="_delete_a_ingress">delete an Ingress</h3>
 <div class="listingblock">
 <div class="content">
 <pre>DELETE /apis/extensions/v1beta1/namespaces/{namespace}/ingresses/{name}</pre>

_includes/v1.3/v1-definitions.html

@@ -2560,7 +2560,7 @@ The resulting set of endpoints can be viewed as:<br>
 <div class="sect2">
 <h3 id="_v1_flexvolumesource">v1.FlexVolumeSource</h3>
 <div class="paragraph">
-<p>FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p>
+<p>FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p>
 </div>
 <table class="tableblock frame-all grid-all" style="width:100%; ">
 <colgroup>
@@ -3268,7 +3268,7 @@ The resulting set of endpoints can be viewed as:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">flexVolume</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_flexvolumesource">v1.FlexVolumeSource</a></p></td>
 <td class="tableblock halign-left valign-top"></td>
@@ -5555,7 +5555,7 @@ The resulting set of endpoints can be viewed as:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">flexVolume</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_flexvolumesource">v1.FlexVolumeSource</a></p></td>
 <td class="tableblock halign-left valign-top"></td>

_includes/v1.3/v1-operations.html

@@ -2676,7 +2676,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_a_endpoints">create a Endpoints</h3>
+<h3 id="_create_a_endpoints">create an Endpoints</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /api/v1/namespaces/{namespace}/endpoints</pre>
@@ -3057,7 +3057,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_delete_a_endpoints">delete a Endpoints</h3>
+<h3 id="_delete_a_endpoints">delete an Endpoints</h3>
 <div class="listingblock">
 <div class="content">
 <pre>DELETE /api/v1/namespaces/{namespace}/endpoints/{name}</pre>
@@ -3619,7 +3619,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_a_event">create a Event</h3>
+<h3 id="_create_a_event">create an Event</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /api/v1/namespaces/{namespace}/events</pre>
@@ -4000,7 +4000,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_delete_a_event">delete a Event</h3>
+<h3 id="_delete_a_event">delete an Event</h3>
 <div class="listingblock">
 <div class="content">
 <pre>DELETE /api/v1/namespaces/{namespace}/events/{name}</pre>

_includes/v1.4/extensions-v1beta1-definitions.html

@@ -69,12 +69,6 @@
 <li>
 <p><a href="#_v1beta1_networkpolicylist">v1beta1.NetworkPolicyList</a></p>
 </li>
-<li>
-<p><a href="#_v1beta1_storageclass">v1beta1.StorageClass</a></p>
-</li>
-<li>
-<p><a href="#_v1beta1_storageclasslist">v1beta1.StorageClassList</a></p>
-</li>
 </ul>
 </div>
 </div>
@@ -1213,71 +1207,6 @@ Examples:<br>
 </tbody>
 </table>
 
-</div>
-<div class="sect2">
-<h3 id="_v1beta1_storageclass">v1beta1.StorageClass</h3>
-<div class="paragraph">
-<p>StorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned.</p>
-</div>
-<div class="paragraph">
-<p>StorageClasses are non-namespaced; the name of the storage class according to etcd is in ObjectMeta.Name.</p>
-</div>
-<table class="tableblock frame-all grid-all" style="width:100%; ">
-<colgroup>
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;"> 
-</colgroup>
-<thead>
-<tr>
-<th class="tableblock halign-left valign-top">Name</th>
-<th class="tableblock halign-left valign-top">Description</th>
-<th class="tableblock halign-left valign-top">Required</th>
-<th class="tableblock halign-left valign-top">Schema</th>
-<th class="tableblock halign-left valign-top">Default</th>
-</tr>
-</thead>
-<tbody>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">kind</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#types-kinds">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#types-kinds</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">apiVersion</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#resources">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#resources</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">metadata</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Standard object&#8217;s metadata. More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#metadata">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#metadata</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_objectmeta">v1.ObjectMeta</a></p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">provisioner</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Provisioner indicates the type of the provisioner.</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">parameters</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Parameters holds the parameters for the provisioner that should create volumes of this storage class.</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-</tbody>
-</table>
-
 </div>
 <div class="sect2">
 <h3 id="_v1_execaction">v1.ExecAction</h3>
@@ -1859,61 +1788,6 @@ Populated by the system when a graceful deletion is requested. Read-only. More i
 <div class="paragraph">
 <p>Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.</p>
 </div>
-</div>
-<div class="sect2">
-<h3 id="_v1beta1_storageclasslist">v1beta1.StorageClassList</h3>
-<div class="paragraph">
-<p>StorageClassList is a collection of storage classes.</p>
-</div>
-<table class="tableblock frame-all grid-all" style="width:100%; ">
-<colgroup>
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;"> 
-</colgroup>
-<thead>
-<tr>
-<th class="tableblock halign-left valign-top">Name</th>
-<th class="tableblock halign-left valign-top">Description</th>
-<th class="tableblock halign-left valign-top">Required</th>
-<th class="tableblock halign-left valign-top">Schema</th>
-<th class="tableblock halign-left valign-top">Default</th>
-</tr>
-</thead>
-<tbody>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">kind</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#types-kinds">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#types-kinds</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">apiVersion</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#resources">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#resources</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">metadata</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Standard list metadata More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#metadata">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#metadata</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_unversioned_listmeta">unversioned.ListMeta</a></p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">items</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Items is the list of StorageClasses</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1beta1_storageclass">v1beta1.StorageClass</a> array</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-</tbody>
-</table>
-
 </div>
 <div class="sect2">
 <h3 id="_v1_flockervolumesource">v1.FlockerVolumeSource</h3>
@@ -6180,7 +6054,7 @@ Both these may change in the future. Incoming requests are matched against the h
 <tbody>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">path</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Path is an extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Path is an extended POSIX regex as defined by IEEE Std 1003.1, (i.e. this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
@@ -6328,7 +6202,7 @@ Both these may change in the future. Incoming requests are matched against the h
 </div>
 <div id="footer">
 <div id="footer-text">
-Last updated 2016-09-01 21:16:11 UTC
+Last updated 2016-09-09 01:13:48 UTC
 </div>
 </div>
 </body>

_includes/v1.4/v1-definitions.html

@@ -6391,7 +6391,7 @@ The resulting set of endpoints can be viewed as:<br>
 <div class="sect2">
 <h3 id="_v1alpha1_eviction">v1alpha1.Eviction</h3>
 <div class="paragraph">
-<p>Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod.  A request to cause such an eviction is created by POSTing to &#8230;/pods/foo/evictions.</p>
+<p>Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod.  A request to cause such an eviction is created by POSTing to &#8230;/pods/&lt;pod name&gt;/evictions.</p>
 </div>
 <table class="tableblock frame-all grid-all" style="width:100%; ">
 <colgroup>

_includes/v1.4/v1-operations.html

@@ -2676,7 +2676,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_a_endpoints">create a Endpoints</h3>
+<h3 id="_create_a_endpoints">create an Endpoints</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /api/v1/namespaces/{namespace}/endpoints</pre>
@@ -3057,7 +3057,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_delete_a_endpoints">delete a Endpoints</h3>
+<h3 id="_delete_a_endpoints">delete an Endpoints</h3>
 <div class="listingblock">
 <div class="content">
 <pre>DELETE /api/v1/namespaces/{namespace}/endpoints/{name}</pre>
@@ -3619,7 +3619,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_a_event">create a Event</h3>
+<h3 id="_create_a_event">create an Event</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /api/v1/namespaces/{namespace}/events</pre>
@@ -4000,7 +4000,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_delete_a_event">delete a Event</h3>
+<h3 id="_delete_a_event">delete an Event</h3>
 <div class="listingblock">
 <div class="content">
 <pre>DELETE /api/v1/namespaces/{namespace}/events/{name}</pre>
@@ -7885,7 +7885,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_eviction_of_a_eviction">create eviction of a Eviction</h3>
+<h3 id="_create_eviction_of_a_eviction">create eviction of an Eviction</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /api/v1/namespaces/{namespace}/pods/{name}/eviction</pre>

_layouts/docwithnav.html

@@ -1,23 +1,32 @@
-{% for thistoc in site.data.globals.tocs %}{% if foundTOC %}{% break %}{% else %}{% assign tree = site.data[thistoc].toc %}{% include tocsearch.html %}{% endif %}{% endfor %}
+{% for current_toc in site.tocs %}
-{% for override in site.data.overrides.overrides %}{% if page.path contains override.path %}{% assign notitle = "true" %}{% endif %}{% endfor %}
+  {% if found_toc %}
+    {% break %}
+  {% else %}
+    {% assign toc=site.data[current_toc] %}
+    {% include tocsearch.html tree=toc.toc toc=toc %}
+  {% endif %}
+{% endfor %}
+
 <!Doctype html>
-<html id="docs" class="{{site.data[foundTOC].bigheader}}">
+<html id="docs" class="{{ toc.bigheader }}">
 
 {% include head-header.html %}
 
 <!--  HERO  -->
 <section id="hero" class="light-text">
-  <h1>{{ site.data[foundTOC].bigheader }}</h1>
+  <h1>{{ toc.bigheader }}</h1>
-  <h5>{{ site.data[foundTOC].abstract }}</h5>
+  <h5>{{ toc.abstract }}</h5>
   <div id="vendorStrip" class="light-text">
     <ul>
-      <li><a href="/docs/" {% if site.data[foundTOC].bigheader == "Guides" %}class="YAH"{% endif %}>GUIDES</a></li>
+      <li><a href="/docs/" {% if toc.bigheader == "Kubernetes Documentation" %}class="YAH"{% endif %}>DOCS HOME</a></li>
-      <li><a href="/docs/tutorials/" {% if site.data[foundTOC].bigheader == "Tutorials" %}class="YAH"{% endif %}>TUTORIALS</a></li>
+      <li><a href="/docs/user-guide/" {% if toc.bigheader == "Guides" %}class="YAH"{% endif %}>GUIDES</a></li>
-      <li><a href="/docs/tasks/" {% if site.data[foundTOC].bigheader == "Tasks" %}class="YAH"{% endif %}>TASKS</a></li>
+      <li><a href="/docs/tutorials/" {% if toc.bigheader == "Tutorials" %}class="YAH"{% endif %}>TUTORIALS</a></li>
-      <li><a href="/docs/concepts/" {% if site.data[foundTOC].bigheader == "Concepts" %}class="YAH"{% endif %}>CONCEPTS</a></li>
+      <li><a href="/docs/tasks/" {% if toc.bigheader == "Tasks" %}class="YAH"{% endif %}>TASKS</a></li>
-      <li><a href="/docs/reference" {% if site.data[foundTOC].bigheader == "Reference Documentation" %}class="YAH"{% endif %}>REFERENCE</a></li>
+      <li><a href="/docs/concepts/" {% if toc.bigheader == "Concepts" %}class="YAH"{% endif %}>CONCEPTS</a></li>
-      <li><a href="/docs/samples" {% if site.data[foundTOC].bigheader == "Samples" %}class="YAH"{% endif %}>SAMPLES</a></li>
+      <li><a href="/docs/reference/" {% if toc.bigheader == "Reference Documentation" %}class="YAH"{% endif %}>REFERENCE</a></li>
-      <li><a href="/docs/troubleshooting/" {% if site.data[foundTOC].bigheader == "Support" %}class="YAH"{% endif %}>SUPPORT</a></li>
+      <li><a href="/docs/tools/" {% if toc.bigheader == "Tools" %}class="YAH"{% endif %}>TOOLS</a></li>
+      <li><a href="/docs/samples/" {% if toc.bigheader == "Samples" %}class="YAH"{% endif %}>SAMPLES</a></li>
+      <li><a href="/docs/troubleshooting/" {% if toc.bigheader == "Support" %}class="YAH"{% endif %}>SUPPORT</a></li>
     </ul>
     <div id="searchBox">
       <input type="text" id="search" placeholder="Search" onkeydown="if (event.keyCode==13) window.location.replace('/docs/search/?q=' + this.value)">
@@ -28,34 +37,40 @@
 <section id="encyclopedia">
   <div id="docsToc">
         <div class="pi-accordion">
-        {% assign tree = site.data[foundTOC].toc %}{% include tree.html %}
+        {% if toc.bigheader != "Kubernetes Documentation" %}
+          {% include_cached tree.html tree=toc.toc %}
+        {% endif %}
         </div> <!-- /pi-accordion -->
     <button class="push-menu-close-button" onclick="kub.toggleToc()"></button>
   </div> <!-- /docsToc -->
   <div id="docsContent">
         <p><a href="/editdocs#{{ page.path }}" id="editPageButton">Edit This Page</a></p>
-      {% if notitle != "true" %}<h1>{{ title }}</h1>{% endif %}
+
-    {{ content }}
+        {% unless page.notitle %}
+          <h1>{{ page.title }}</h1>
+        {% endunless %}
+
+        {{ content }}
+
         <p><a href=""><img src="https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/{{ page.path }}?pixel" alt="Analytics" /></a>
-        {% if page.url != "/404.html" and page.url != "/docs/search/" %}<div id="pd_rating_holder_8345992"></div>
+        {% if page.url != "/404.html" and page.url != "/docs/search/" %}
 		<script type="text/javascript">
 	        PDRTJS_settings_8345992 = {
 		        "id" : "8345992",
-		        "unique_id" : "{{page.url}}",
+		        "unique_id" : "{{ page.url }}",
-		        "title" : "{{title}}",
+		        "title" : "{{ page.title }}",
-		        "permalink" : "http://kubernetes.github.io{{page.url}}"
+		        "permalink" : "http://kubernetes.github.io{{ page.url }}"
 	        };
 	        (function(d,c,j){if(!document.getElementById(j)){var pd=d.createElement(c),s;pd.id=j;pd.src=('https:'==document.location.protocol)?'https://polldaddy.com/js/rating/rating.js':'http://i0.poll.fm/js/rating/rating.js';s=document.getElementsByTagName(c)[0];s.parentNode.insertBefore(pd,s);}}(document,'script','pd-rating-js'));
 		</script>
 		<a href="" onclick="window.open('https://github.com/kubernetes/kubernetes.github.io/issues/new?title=Issue%20with%20' +
-		window.location.pathname + '&body=Issue%20with%20' +
+		window.location.pathname)" class="button issue">Create an Issue</a>
-		window.location.pathname)" class="button issue">Create Issue</a>
+		<a href="/editdocs#{{ page.path }}" class="button issue">Edit this Page</a>
-		<a href="/editdocs#{{ page.path }}" class="button issue">Edit This Page</a>
 	{% endif %}
 	</div>
 </section>
 
-{% include footer.html %}
+{% include_cached footer.html %}
 
 <button class="flyout-button" onclick="kub.toggleToc()"></button>
 
@@ -77,6 +92,34 @@
   })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
   ga('create', 'UA-36037335-10', 'auto');
   ga('send', 'pageview');
+
+  // hide docs nav area if no nav is present, or if nav only contains a link to the current page
+  (function () {
+	  window.addEventListener('DOMContentLoaded', init)
+
+	  // play nice with our neighbors
+	  function init() {
+		  window.removeEventListener('DOMContentLoaded', init)
+		  hideNav()
+	  }
+
+	  function hideNav(toc){
+		  if (!toc) toc = document.querySelector('#docsToc')
+		  var container = toc.querySelector('.container')
+
+		  // container is built dynamically, so it may not be present on the first runloop
+		  if (container) {
+			  if (container.childElementCount === 0 || toc.querySelectorAll('a.item').length === 1) {
+				  toc.style.display = 'none'
+				  document.getElementById('docsContent').style.width = '100%'
+			  }
+		  } else {
+			  requestAnimationFrame(function () {
+				  hideNav(toc)
+			  })
+		  }
+	  }
+  })();
 </script>
 <!-- Commenting out AnswerDash for now; we need to work on our list of questions/answers/design first
 <!-- Start of AnswerDash script <script>var AnswerDash;!function(e,t,n,s,a){if(!t.getElementById(s)){var i,r=t.createElement(n),c=t.getElementsByTagName(n)[0];e[a]||(i=e[a]=function(){i.__oninit.push(arguments)},i.__oninit=[]),r.type="text/javascript",r.async=!0,r.src="https://p1.answerdash.com/answerdash.min.js?siteid=756",r.setAttribute("id",s),c.parentNode.insertBefore(r,c)}}(window,document,"script","answerdash-script","AnswerDash");</script> <!-- End of AnswerDash script -->

_sass/_base.sass

@@ -234,6 +234,40 @@ header
 			color: $blue
 			text-decoration: none
 
+// Global Nav - 12/9/2016 Update
+
+ul.global-nav
+	display: none
+
+	li
+		display: inline-block
+		margin-right: 14px
+
+		a
+			color: #fff
+			font-weight: 400
+			padding: 0
+			position: relative
+
+			&.active:after
+				position: absolute
+				width: 100%
+				height: 2px
+				content: ''
+				bottom: -4px
+				left: 0
+				background: #fff
+
+
+.flip-nav ul.global-nav li a,
+.open-nav ul.global-nav li a,
+	color: #333
+
+.flip-nav ul.global-nav li a.active:after,
+.open-nav ul.global-nav li a.active:after,
+
+	background: $blue
+
 // FLIP NAV
 .flip-nav
 	header
@@ -301,6 +335,26 @@ header
 	padding-left: 0
 	padding-right: 0
 	margin-bottom: 0
+	position: relative
+
+	&.bot-bar:after
+		display: block
+		margin-bottom: -20px
+		height: 8px
+		width: 100%
+		background-color: transparentize(white, 0.9)
+		content: ''
+	
+	&.no-sub
+		
+		h5
+			display: none
+		
+		h1
+			margin-bottom: 20px
+
+#home #hero:after
+	display: none
 
 // VENDOR STRIP
 #vendorStrip
@@ -390,6 +444,14 @@ footer
 		height: 0
 		overflow: hidden
 		
+	&.button
+		background-image: none
+		width: auto
+		height: auto
+		
+		&:hover
+			color: $blue
+
 a.twitter
 	background-position: 0 0
 
@@ -474,6 +536,19 @@ section
 			margin: 0 auto
 			height: 44px
 			line-height: 44px
+			position: relative
+			
+			&:before
+				position: absolute
+				width: 15px
+				height: 15px
+				content: ''
+				right: 8px
+				top: 7px
+				background-image: url(/images/search-icon.svg)
+				background-repeat: no-repeat
+				background-size: 100% 100%
+				z-index: 1
 
 		#search
 			width: 100%
@@ -482,6 +557,10 @@ section
 			line-height: 30px
 			font-size: 16px
 			vertical-align: top
+			background: #fff
+			border: none
+			border-radius: 4px
+			position: relative
 
 
 #encyclopedia
@@ -704,7 +783,6 @@ dd
 		font-weight: 500
 		margin-bottom: 30px
 		padding-bottom: 10px
-		border-bottom: 1px solid #cccccc
 
 		// Make sure anchor links aren't hidden by the header
 		&:before
@@ -714,6 +792,9 @@ dd
 			height: $header-clearance
 			visibility: hidden
 
+	h1,h2
+		border-bottom: 1px solid #cccccc
+		
 	h1
 		font-size: 32px
 		padding-right: 60px
@@ -723,9 +804,12 @@ dd
 
 	h3
 		font-size: 24px
+		font-weight: 300
+		margin-bottom: 5px
 
 	h4
 		font-size: 20px
+		margin-bottom: 0px
 
 	h5, h6
 		font-size: 16px
@@ -745,7 +829,7 @@ dd
 		background-color: $light-grey
 		color: $dark-grey
 		font-family: $mono-font
-		vertical-align: bottom
+		vertical-align: baseline
 		font-size: 14px
 		font-weight: bold
 		padding: 2px 4px
@@ -874,11 +958,22 @@ dd
 	img
 		max-width: 100%
 
+	a
+		//font-weight: 700
+		text-decoration: underline
+
+	a:visited
+		color: blueviolet
+
 	a.button
 		border-radius: 2px
+		text-decoration: none
+		
+		&:visited
+			color: white
 
 	a.issue
-		margin-left: 20px
+		margin-left: 0px
 
 .fixed footer
 	position: fixed
@@ -989,7 +1084,7 @@ $feature-box-div-margin-bottom: 40px
 #video
 	width: 100%
 	position: relative
-	background-image: url(/images/kub_video_thm.jpg)
+	background-image: url(/images/kub_video_banner.jpg)
 	background-position: center center
 	background-size: cover
 

_sass/_desktop.sass

@@ -3,6 +3,15 @@ $vendor-strip-height: 44px
 $video-section-height: 550px
 
 @media screen and (min-width: 1025px)
+	#hamburger
+		display: none
+
+	ul.global-nav
+		display: inline-block
+
+	#docs #vendorStrip #searchBox:before
+		top: 15px
+
 	#vendorStrip
 		height: $vendor-strip-height
 		line-height: $vendor-strip-height
@@ -40,7 +49,7 @@ $video-section-height: 550px
 
 				#searchBox
 					float: right
-					width: 30%
+					width: 320px
 
 				#search
 					vertical-align: middle
@@ -65,7 +74,7 @@ $video-section-height: 550px
 
 
 	#encyclopedia
-		padding: 50px 50px 20px 20px
+		padding: 50px 50px 100px 100px
 		clear: both
 
 	#docsToc
@@ -89,6 +98,11 @@ $video-section-height: 550px
 		main
 			max-width: $main-max-width
 	
+	header, #vendorStrip, #encyclopedia, #hero h1, #hero h5, #docs #hero h1, #docs #hero h5,
+	#community #hero h1, .gridPage #hero h1, #community #hero h5, .gridPage #hero h5
+		padding-left: 100px
+		padding-right: 100px
+
 	#home
 		section, header, footer
 			main
@@ -121,7 +135,7 @@ $video-section-height: 550px
 	#video
 		height: $video-section-height
 		position: relative
-		background-image: url(../images/kub_video_thm.jpg)
+		background-image: url(../images/kub_video_banner.jpg)
 		background-position: center center
 		background-size: cover
 
@@ -164,10 +178,11 @@ $video-section-height: 550px
 			margin-bottom: 20px
 
 			a
-				width: 20%
+				width: 16.65%
 				float: left
 				font-size: 24px
 				font-weight: 300
+				white-space: nowrap
 
 		.social
 			padding: 0 30px
@@ -275,7 +290,7 @@ $video-section-height: 550px
 			text-align: left
 
 			h1
-				padding: 20px
+				padding: 20px 100px
 
 		#tryKubernetes
 			width: auto

_sass/_tablet.sass

@@ -222,8 +222,7 @@ $feature-box-div-width: 45%
 			text-align: center
 
 			a
-				font-size: 22px
+				width: 30%
-				width: auto
 				padding: 0 20px
 
 		.social

case-studies/index.html

@@ -17,19 +17,19 @@ title: Case Studies
 			<div class="case-studies">
 				<div class="case-study">
 					<img src="/images/case_studies/pearson.png" alt="Pearson">
-					<p class="quote">“We chose Kubernetes because of its flexibility, ease of management and the way it improves our engineers’ productivity.”</p>
+					<p class="quote">"We chose Kubernetes because of its flexibility, ease of management and the way it improves our engineers' productivity."</p>
 					<!--<p class="attrib">— Chris Jackson, Director for Cloud Product Engineering, Pearson</p>-->
 					<a href="./pearson/">Read about Pearson</a>
 				</div>
 				<div class="case-study">
 					<img src="/images/case_studies/wikimedia.png" alt="Wikimedia">
-					<p class="quote">“With Kubernetes, we’re simplifying our environment and making it easier for developers to build the tools that make wikis run better.”</p>
+					<p class="quote">"With Kubernetes, we're simplifying our environment and making it easier for developers to build the tools that make wikis run better."</p>
 					<!--<p class="attrib">— Yuvi Panda, Operations Engineer, Wikimedia Foundation</p>-->
 					<a href="./wikimedia/">Read about Wikimedia</a>
 				</div>
 				<div class="case-study">
 					<img src="/images/case_studies/ebay.png" alt="eBay">
-					<p class="quote">Inside eBay’s shift to Kubernetes and containers atop OpenStack</p>
+					<p class="quote">Inside eBay's shift to Kubernetes and containers atop OpenStack</p>
 					<a href="http://www.nextplatform.com/2015/11/12/inside-ebays-shift-to-kubernetes-and-containers-atop-openstack/">Read about eBay</a>
 				</div>
 				<div class="case-study">
@@ -45,7 +45,7 @@ title: Case Studies
 <section id="video">
 	<main>
 		<!--<div>-->
-			<!--<h3>“I don’t want to deploy software the old way ever again”</h3>-->
+			<!--<h3>"I don't want to deploy software the old way ever again"</h3>-->
 			<!--<p class="attrib">— Dylan Carney, Lead Software Engineer, Zulily</p>-->
 			<!--<img src="/images/case_studies/zulily.png" id="zulilyLogo" alt="zulily">-->
 		<!--</div>-->
@@ -76,8 +76,13 @@ title: Case Studies
 			<a target="_blank" href="http://superuser.openstack.org/articles/how-ancestry-com-s-open-source-strategy-combines-kubernetes-and-openstack"><img src="/images/case_studies/ancestry.png" alt="Ancestry.com"></a>
 			<a target="_blank" href="https://cloud.google.com/customers/ccp-games/"><img src="/images/case_studies/ccp.png" alt="CCP Games"></a>
 			<a target="_blank" href="https://www.openstack.org/videos/video/running-kubernetes-on-openstack-at-liveperson"><img src="/images/case_studies/liveperson.png" alt="LivePerson"></a>
-			<a target="_blank" href="http://techblog.yahoo.co.jp/infrastructure/os_n_k8s/"><img src="/images/case_studies/yahooJapan_logo.png" alt="Yahoo! Japan"></a>
+			<a target="_blank" href="https://youtu.be/YkOY7DgXKyw"><img src="/images/case_studies/monzo_logo.png" alt="monzo"></a>
 			<a target="_blank" href="https://blog.box.com/blog/kubernetes-box-microservices-maximum-velocity/"><img src="/images/case_studies/box_logo.png" alt="Box"></a>
+			<a target="_blank" href="https://cloudplatform.googleblog.com/2016/09/bringing-Pokemon-GO-to-life-on-Google-Cloud.html"><img src="/images/case_studies/pokemon_go_logo.png" alt="Pokemon GO"></a>
+			<a target="_blank" href="http://blog.kubernetes.io/2016/10/kubernetes-and-openstack-at-yahoo-japan.html"><img src="/images/case_studies/yahooJapan_logo.png" alt="Yahoo! Japan"></a>
+			<a target="_blank" href="https://cloud.google.com/customers/philips/"><img src="/images/case_studies/philips_logo.png" alt="Philips"></a>
+			<a target="_blank" href="https://youtu.be/EC_ZRLsw58M"><img src="/images/case_studies/buffer_logo.png" alt="buffer"></a>
+			<a target="_blank" href="https://youtu.be/lmeFkH-rHII"><img src="/images/case_studies/comcast_logo.png" alt="Comcast"></a>
 			<a href="./wikimedia/"><img src="/images/case_studies/wikimedia_logo.png" alt="Wikimedia"></a>
 			<a href="./pearson/"><img src="/images/case_studies/pearson_logo.png" alt="Pearson"></a>
 			<a target="_blank" href="#" onclick="event.preventDefault(); kub.showVideo()"><img src="/images/case_studies/zulily_logo.png" alt="zulily"></a>

case-studies/pearson.html

@@ -13,13 +13,13 @@ title: Pearson Case Study
 <section id="mainContent">
 	<main>
 		<div class="content">
-			<h3 id="caseStudyTitle">Using Kubernetes to reinvent the world’s largest educational company</h3>
+			<h3 id="caseStudyTitle">Using Kubernetes to reinvent the world's largest educational company</h3>
 			<p>
-				Pearson, the world’s education company, serving 75 million learners worldwide, set a goal to more than double that number to 200 million by 2025. A key part of this growth is in digital learning experiences, and that  requires an infrastructure platform that is able to scale quickly and deliver products to market faster. So Pearson’s Cloud Technology team chose Kubernetes to help build a platform to meet the business requirements.			</p>
+				Pearson, the world's education company, serving 75 million learners worldwide, set a goal to more than double that number to 200 million by 2025. A key part of this growth is in digital learning experiences, and that  requires an infrastructure platform that is able to scale quickly and deliver products to market faster. So Pearson's Cloud Technology team chose Kubernetes to help build a platform to meet the business requirements.			</p>
 			<div class="feature">
 				<img src="/images/case_studies/pearson.png" alt="Pearson">
 				<p class="quote">
-					“To transform our infrastructure, we had to think beyond simply enabling automated provisioning, we realized we had to build a platform that would allow Pearson developers to build manage and deploy applications in a completely different way. We chose Kubernetes because of its flexibility, ease of management and the way it would improve our engineers’ productivity.”				</p>
+					"To transform our infrastructure, we had to think beyond simply enabling automated provisioning, we realized we had to build a platform that would allow Pearson developers to build manage and deploy applications in a completely different way. We chose Kubernetes because of its flexibility, ease of management and the way it would improve our engineers' productivity."				</p>
 				<p class="attrib">— Chris Jackson, Director for Cloud Product Engineering, Pearson</p>
 			</div>
 		</div>
@@ -38,7 +38,7 @@ title: Pearson Case Study
 			<div class="bullet">
 				<h4>Why Kubernetes:</h4>
 				<ul>
-					<li>Kubernetes will allow Pearson’s teams to develop their apps in a consistent manner, saving time and minimizing complexity.</li>
+					<li>Kubernetes will allow Pearson's teams to develop their apps in a consistent manner, saving time and minimizing complexity.</li>
 				</ul>
 			</div>
 			<div class="bullet">
@@ -52,7 +52,7 @@ title: Pearson Case Study
 			<div class="bullet">
 				<h4>Results:</h4>
 				<ul>
-					<li>Pearson is building an enterprise-wide platform for delivering innovative, web-based educational content. They expect engineers’ productivity to increase by up to 20 percent.</li>
+					<li>Pearson is building an enterprise-wide platform for delivering innovative, web-based educational content. They expect engineers' productivity to increase by up to 20 percent.</li>
 				</ul>
 			</div>
 		</div>
@@ -63,9 +63,9 @@ title: Pearson Case Study
 	<main>
 		<div class="content">
 			<h4>Kubernetes powers a comprehensive developer experience</h4>
-			<p>Pearson wanted to use as much open source technology as possible for the platform given that it provides both technical and commercial benefits over the duration of the project. Jackson says, “Building an infrastructure platform based on open source technology in Pearson was a no-brainer, the sharing of technical challenges and advanced use cases in a community of people with talent far beyond what we could hire independently allows us to innovate at a level we could not reach on our own. Our engineers enjoy returning code to the community and participating in talks, blogs and meetings, it’s a great way for us to allow our team to express themselves and share the pride they have in their work.”</p>
+			<p>Pearson wanted to use as much open source technology as possible for the platform given that it provides both technical and commercial benefits over the duration of the project. Jackson says, "Building an infrastructure platform based on open source technology in Pearson was a no-brainer, the sharing of technical challenges and advanced use cases in a community of people with talent far beyond what we could hire independently allows us to innovate at a level we could not reach on our own. Our engineers enjoy returning code to the community and participating in talks, blogs and meetings, it's a great way for us to allow our team to express themselves and share the pride they have in their work."</p>
-			<p>It also wanted to use a container-focused platform. Pearson has 400 development groups and diverse brands with varying business and technical needs. With containers, each brand could experiment with building new types of content using their preferred technologies, and then deliver it using containers. Pearson chose Kubernetes because it believes that is the best technology for managing containers, has the widest community support and offers the most flexible and powerful tools.“</p>
+			<p>It also wanted to use a container-focused platform. Pearson has 400 development groups and diverse brands with varying business and technical needs. With containers, each brand could experiment with building new types of content using their preferred technologies, and then deliver it using containers. Pearson chose Kubernetes because it believes that is the best technology for managing containers, has the widest community support and offers the most flexible and powerful tools."</p>
-			<p>Kubernetes is at the core of the platform we’ve built for developers. After we get our big spike in back-to-school in traffic, much of Pearson’s traffic will interact with Kubernetes. It is proving to be as effective as we had hoped,” Jackson says.</p>
+			<p>Kubernetes is at the core of the platform we've built for developers. After we get our big spike in back-to-school in traffic, much of Pearson's traffic will interact with Kubernetes. It is proving to be as effective as we had hoped," Jackson says.</p>
 		</div>
 	</main>
 </section>
@@ -74,9 +74,9 @@ title: Pearson Case Study
 	<main>
 		<div class="content">
 			<h4>Encouraging experimentation, saving engineers time</h4>
-			<p>With the new platform, Pearson will increase stability and performance, and to bring products to market more quickly. The company says its engineers will also get a productivity boost because they won’t spend time managing infrastructure. Jackson estimates 15 to 20 percent in productivity savings.</p>
+			<p>With the new platform, Pearson will increase stability and performance, and to bring products to market more quickly. The company says its engineers will also get a productivity boost because they won't spend time managing infrastructure. Jackson estimates 15 to 20 percent in productivity savings.</p>
 			<p>Beyond that, Pearson says the platform will encourage innovation because of the ease with which new applications can be developed, and because applications will be deployed far more quickly than in the past. It expects that will help the company meet its goal of reaching 200 million learners within the next 10 years.</p>
-			<p>“We’re already seeing tremendous benefits with Kubernetes — improved engineering productivity, faster delivery of applications and a simplified infrastructure. But this is just the beginning. Kubernetes will help transform the way that educational content is delivered online,” says Jackson.</p>
+			<p>"We're already seeing tremendous benefits with Kubernetes — improved engineering productivity, faster delivery of applications and a simplified infrastructure. But this is just the beginning. Kubernetes will help transform the way that educational content is delivered online," says Jackson.</p>
 		</div>
 	</main>
 </section>

case-studies/wikimedia.html

@@ -20,7 +20,7 @@ title: Wikimedia Case Study
 			<div class="feature">
 				<img src="/images/case_studies/wikimedia.png" alt="Wikimedia">
 				<p class="quote">
-					“Wikimedia Tool Labs is vital for making sure wikis all around the world work as well as they possibly can. Because it’s grown organically for almost 10 years, it has become an extremely challenging environment and difficult to maintain. It’s like a big ball of mud — you really can’t see through it. With Kubernetes, we’re simplifying the environment and making it easier for developers to build the tools that make wikis run better.”
+					"Wikimedia Tool Labs is vital for making sure wikis all around the world work as well as they possibly can. Because it's grown organically for almost 10 years, it has become an extremely challenging environment and difficult to maintain. It's like a big ball of mud — you really can't see through it. With Kubernetes, we're simplifying the environment and making it easier for developers to build the tools that make wikis run better."
 				</p>
 				<p class="attrib">— Yuvi Panda, operations engineer at Wikimedia Foundation and Wikimedia Tool Labs</p>
 			</div>
@@ -67,13 +67,13 @@ title: Wikimedia Case Study
 		<div class="content">
 			<h4>Using Kubernetes to provide tools for maintaining wikis</h4>
 			<p>
-				Wikimedia Tool Labs is run by a staff of four-and-a-half paid employees and two volunteers. The infrastructure didn't make it easy or intuitive for developers to build bots and other tools to make wikis work more easily. Yuvi says, “It’s incredibly chaotic. We have lots of Perl and Bash duct tape on top of it. Everything is super fragile.”
+				Wikimedia Tool Labs is run by a staff of four-and-a-half paid employees and two volunteers. The infrastructure didn't make it easy or intuitive for developers to build bots and other tools to make wikis work more easily. Yuvi says, "It's incredibly chaotic. We have lots of Perl and Bash duct tape on top of it. Everything is super fragile."
 			</p>
 			<p>
 				To solve the problem, Wikimedia Tool Labs migrated parts of its infrastructure to Kubernetes, in preparation for eventually moving its entire system. Yuvi said Kubernetes greatly simplifies maintenance. The goal is to allow developers creating bots and other tools to use whatever development methods they want, but make it easier for the Wikimedia Tool Labs to maintain the required infrastructure for hosting and sharing them.
 			</p>
 			<p>
-				“With Kubernetes, I’ve been able to remove a lot of our custom-made code, which makes everything easier to maintain. Our users’ code also runs in a more stable way than previously,” says Yuvi.
+				"With Kubernetes, I've been able to remove a lot of our custom-made code, which makes everything easier to maintain. Our users' code also runs in a more stable way than previously," says Yuvi.
 			</p>
 		</div>
 	</main>
@@ -84,13 +84,13 @@ title: Wikimedia Case Study
 		<div class="content">
 			<h4>Simplifying infrastructure and keeping wikis running better</h4>
 			<p>
-				Wikimedia Tool Labs has seen great success with the initial Kubernetes deployment. Old code is being simplified and eliminated, contributing developers don’t have to change the way they write their tools and bots, and those tools and bots run in a more stable fashion than they have in the past. The paid staff and volunteers are able to better keep up with fixing issues.
+				Wikimedia Tool Labs has seen great success with the initial Kubernetes deployment. Old code is being simplified and eliminated, contributing developers don't have to change the way they write their tools and bots, and those tools and bots run in a more stable fashion than they have in the past. The paid staff and volunteers are able to better keep up with fixing issues.
 			</p>
 			<p>
-				In the future, with a more complete migration to Kubernetes, Wikimedia Tool Labs expects to make it even easier to host and maintain the bots and tools that help run wikis across the world. The tool labs already host approximately 1,300 tools and bots from 800 volunteers, with many more being submitted every day. Twenty percent of the tool labs’ web tools that account for more than 60 percent of web traffic now run on Kubernetes. The tool labs has a 25-node cluster that keeps up with each new Kubernetes release. Many existing web tools are migrating to Kubernetes.
+				In the future, with a more complete migration to Kubernetes, Wikimedia Tool Labs expects to make it even easier to host and maintain the bots and tools that help run wikis across the world. The tool labs already host approximately 1,300 tools and bots from 800 volunteers, with many more being submitted every day. Twenty percent of the tool labs' web tools that account for more than 60 percent of web traffic now run on Kubernetes. The tool labs has a 25-node cluster that keeps up with each new Kubernetes release. Many existing web tools are migrating to Kubernetes.
 			</p>
 			<p>
-				“Our goal is to make sure that people all over the world can share knowledge as easily as possible. Kubernetes helps with that, by making it easier for wikis everywhere to have the tools they need to thrive,” says Yuvi.
+				"Our goal is to make sure that people all over the world can share knowledge as easily as possible. Kubernetes helps with that, by making it easier for wikis everywhere to have the tools they need to thrive," says Yuvi.
 			</p>
 		</div>
 	</main>

community.html

@@ -10,8 +10,6 @@ title: Community
 	<h1>Community</h1>
 </section>
 
-
-
 <section id="mainContent">
 	<main>
 		<div class="content">
@@ -26,22 +24,8 @@ title: Community
 			<h3>SIGs</h3>
 			<p>Have a special interest in how Kubernetes works with another technology?  See our ever growing
 				<a href="https://github.com/kubernetes/kubernetes/wiki/Special-Interest-Groups-(SIGs)">lists of SIGs</a>,
-				from AWS and Openstack to Big Data and Scalability, there’s a place for you to contribute and instructions
+				from AWS and Openstack to Big Data and Scalability, there's a place for you to contribute and instructions
-				for forming a new SIG if your special interest isn’t covered (yet).</p>
+				for forming a new SIG if your special interest isn't covered (yet).</p>
-		</div>
-		<div class="content">
-			<h3>Customers</h3>
-			<div class="company-logos">
-				<img src="/images/community_logos/zulily_logo.png">
-				<img src="/images/community_logos/we_pay_logo.png">
-				<img src="/images/community_logos/goldman_sachs_logo.png">
-				<img src="/images/community_logos/ebay_logo.png">
-				<img src="/images/community_logos/box_logo.png">
-				<img src="/images/community_logos/wikimedia_logo.png">
-				<img src="/images/community_logos/soundcloud_logo.png">
-				<img src="/images/community_logos/new_york_times_logo.png">
-				<img src="/images/community_logos/kabam_logo.png">
-			</div>
 		</div>
 		<div class="content">
 			<h3>Events</h3>
@@ -50,34 +34,6 @@ title: Community
 				        frameborder="0" scrolling="no"></iframe>
 			</div>
 		</div>
-		<div class="content">
-			<h3>Partners</h3>
-			<p>We are working with a broad group of partners who contribute to the kubernetes core codebase, making it stronger and richer, as well as help in growing the kubernetes ecosystem supporting
-				a sprectrum of compelmenting platforms, from open source solutions to market-leading technologies.</p>
-			<div class="partner-logos">
-        <a href="https://coreos.com/kubernetes"><img src="/images/community_logos/core_os_logo.png"></a>
-				<a href="https://deis.com"><img src="/images/community_logos/deis_logo.png"></a>
-				<a href="https://sysdig.com/blog/monitoring-kubernetes-with-sysdig-cloud/"><img src="/images/community_logos/sysdig_cloud_logo.png"></a>
-				<a href="https://puppet.com/blog/managing-kubernetes-configuration-puppet"><img src="/images/community_logos/puppet_logo.png"></a>
-				<a href="https://www.citrix.com/blogs/2016/07/15/citrix-kubernetes-a-home-run/"><img src="/images/community_logos/citrix_logo.png"></a>
-				<a href="http://wercker.com/workflows/partners/kubernetes/"><img src="/images/community_logos/wercker_logo.png"></a>
-				<a href="http://rancher.com/kubernetes/"><img src="/images/community_logos/rancher_logo.png"></a>
-				<a href="https://www.openshift.com/"><img src="/images/community_logos/red_hat_logo.png"></a>
-				<a href="https://tectonic.com/press/intel-coreos-collaborate-on-openstack-with-kubernetes.html"><img src="/images/community_logos/intel_logo.png"></a>
-				<a href="https://elasticbox.com/kubernetes/"><img src="/images/community_logos/elastickube_logo.png"></a>
-				<a href="https://platform9.com/blog/containers-as-a-service-kubernetes-docker"><img src="/images/community_logos/platform9_logo.png"></a>
-				<a href="http://www.appformix.com/solutions/appformix-for-kubernetes/"><img src="/images/community_logos/appformix_logo.png"></a>
-				<a href="http://kubernetes.io/docs/getting-started-guides/dcos/"><img src="/images/community_logos/mesosphere_logo.png"></a>
-				<a href="http://docs.datadoghq.com/integrations/kubernetes/"><img src="/images/community_logos/datadog_logo.png"></a>
-				<a href="https://apprenda.com/kubernetes-support/"><img src="/images/community_logos/apprenda_logo.png"></a>
-				<a href="http://www.ibm.com/cloud-computing/"><img src="/images/community_logos/ibm_logo.png"></a>
-				<a href="http://info.crunchydata.com/blog/advanced-crunchy-containers-for-postgresql"><img src="/images/community_logos/crunchy_data_logo.png"></a>
-				<a href="https://content.mirantis.com/Containerizing-OpenStack-on-Kubernetes-Video-Landing-Page.html"><img src="/images/community_logos/mirantis_logo.png"></a>
-				<a href="http://blog.aquasec.com/security-best-practices-for-kubernetes-deployment"><img src="/images/community_logos/aqua_logo.png"></a>
-				<a href="https://jujucharms.com/canonical-kubernetes/"><img src="/images/community_logos/ubuntu_cannonical_logo.png"></a>
-				<a href="https://github.com/nuagenetworks/nuage-kubernetes"><img src="/images/community_logos/nuage_network_logo.png"></a>
-			</div>
-		</div>
 	</main>
 </section>
 

docs/admin/accessing-the-api.md

@@ -3,7 +3,7 @@ assignees:
 - bgrant0607
 - erictune
 - lavalamp
-
+title: Overview
 ---
 
 This document describes how access to the Kubernetes API is controlled.
@@ -24,7 +24,7 @@ following diagram:
 In a typical Kubernetes cluster, the API served on port 443.  A TLS connection is
 established.  The API server presents a certificate.  This certificate is
 often self-signed, so `$USER/.kube/config` on the user's machine typically
-contains the root certficate for the API server's certificate, which when specified
+contains the root certificate for the API server's certificate, which when specified
 is used in place of the system default root certificates.  This certificate is typically
 automatically written into your `$USER/.kube/config` when you create a cluster yourself
 using `kube-up.sh`.  If the cluster has multiple users, then the creator needs to share
@@ -52,8 +52,8 @@ On GCE, Client Certificates, Password, Plain Tokens, and JWT Tokens are all enab
 If the request cannot be authenticated, it is rejected with HTTP status code 401.
 Otherwise, the user is authenticated as a specific `username`, and the user name
 is available to subsequent steps to use in their decisions.  Some authenticators
-may also provide the group memberships of the user, while other authenticators
+also provide the group memberships of the user, while other authenticators
-do not (and expect the authorizer to determine these).
+do not.
 
 While Kubernetes uses "usernames" for access control decisions and in request logging,
 it does not have a `user` object nor does it store usernames or other information about
@@ -86,7 +86,7 @@ For version 1.2, clusters created by `kube-up.sh` are configured so that no auth
 required for any request.
 
 As of version 1.3, clusters created by `kube-up.sh` are configured so that the ABAC authorization
-modules is enabled.  However, its input file is initially set to allow all users to do all
+modules are enabled.  However, its input file is initially set to allow all users to do all
 operations.  The cluster administrator needs to edit that file, or configure a different authorizer
 to restrict what users can do.
 
@@ -148,7 +148,7 @@ By default the Kubernetes APIserver serves HTTP on 2 ports:
           - default IP is first non-localhost network interface, change with `--bind-address` flag.
           - request handled by authentication and authorization modules.
           - request handled by admission control module(s).
-          - authentication and authoriation modules run.
+          - authentication and authorisation modules run.
 
 When the cluster is created by `kube-up.sh`, on Google Compute Engine (GCE),
 and on several other cloud providers, the API server serves on port 443.  On

docs/admin/addons.md

@@ -1,4 +1,5 @@
 ---
+title: Installing Addons
 ---
 
 ## Overview
@@ -7,16 +8,20 @@ Add-ons extend the functionality of Kubernetes.
 
 This page lists some of the available add-ons and links to their respective installation instructions.
 
+Add-ons in each section are sorted alphabetically - the ordering does not imply any preferential status.
+
 ## Networking and Network Policy
 
-* [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database.
+* [Calico](http://docs.projectcalico.org/v2.0/getting-started/kubernetes/installation/hosted/) is a secure L3 networking and network policy provider.
-* [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) is a secure L3 networking and network policy provider.
 * [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy.
+* [Flannel](https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml) is an overlay network provider that can be used with Kubernetes.
+* [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API](/docs/user-guide/networkpolicies/). Kubeadm add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize).
+* [Weave Net](https://www.weave.works/docs/net/latest/kube-addon/) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database.
 
 ## Visualization & Control
 
-* [Weave Scope](https://www.weave.works/documentation/scope-latest-installing/#k8s) is a tool for graphically visualizing your containers, pods, services etc. Use it in conjunction with a [Weave Cloud account](https://cloud.weave.works/) or host the UI yourself.
 * [Dashboard](https://github.com/kubernetes/dashboard#kubernetes-dashboard) is a dashboard web interface for Kubernetes.
+* [Weave Scope](https://www.weave.works/documentation/scope-latest-installing/#k8s) is a tool for graphically visualizing your containers, pods, services etc. Use it in conjunction with a [Weave Cloud account](https://cloud.weave.works/) or host the UI yourself.
 
 ## Legacy Add-ons
 

docs/admin/admission-controllers.md

@@ -6,7 +6,7 @@ assignees:
 - erictune
 - janetkuo
 - thockin
-
+title: Using Admission Controllers
 ---
 
 * TOC
@@ -126,7 +126,7 @@ For additional HTTP configuration, refer to the [kubeconfig](/docs/user-guide/ku
 
 When faced with an admission decision, the API Server POSTs a JSON serialized api.imagepolicy.v1alpha1.ImageReview object describing the action. This object contains fields describing the containers being admitted, as well as any pod annotations that match `*.image-policy.k8s.io/*`.
 
-Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for alpha objects and check the “apiVersion” field of the request to ensure correct deserialization. Additionally, the API Server must enable the imagepolicy.k8s.io/v1alpha1 API extensions group (`--runtime-config=imagepolicy.k8s.io/v1alpha1=true`).
+Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for alpha objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the imagepolicy.k8s.io/v1alpha1 API extensions group (`--runtime-config=imagepolicy.k8s.io/v1alpha1=true`).
 
 An example request body:
 
@@ -151,7 +151,7 @@ An example request body:
 }
 ```
 
-The remote service is expected to fill the ImageReviewStatus field of the request and respond to either allow or disallow access. The response body’s “spec” field is ignored and may be omitted. A permissive response would return:
+The remote service is expected to fill the ImageReviewStatus field of the request and respond to either allow or disallow access. The response body's "spec" field is ignored and may be omitted. A permissive response would return:
 
 ```
 {

docs/admin/apparmor/index.md

@@ -1,7 +1,7 @@
 ---
 assignees:
 - stclair
-
+title: AppArmor
 ---
 
 AppArmor is a Linux kernel enhancement that can reduce the potential attack surface of an
@@ -384,7 +384,7 @@ Specifying the default profile to apply to containers when none is provided:
 - **key**: `apparmor.security.beta.kubernetes.io/defaultProfileName`
 - **value**: a profile reference, described above
 
-Specifying the list of profiles Pod containers are allowed to specify:
+Specifying the list of profiles Pod containers is allowed to specify:
 
 - **key**: `apparmor.security.beta.kubernetes.io/allowedProfileNames`
 - **value**: a comma-separated list of profile references (described above)

docs/admin/audit.md

@@ -23,7 +23,7 @@ answer the following questions:
     - to where was it going?
 
 NOTE: Currently, Kubernetes provides only basic audit capabilities, there is still a lot
-of work going on to provide fully featured auditing capabilities (see https://github.com/kubernetes/features/issues/22).
+of work going on to provide fully featured auditing capabilities (see [this issue](https://github.com/kubernetes/features/issues/22)).
 
 Kubernetes audit is part of [kube-apiserver](/docs/admin/kube-apiserver) logging all requests
 coming to the server. Each audit log contains two entries:

docs/admin/authentication.md

@@ -4,9 +4,12 @@ assignees:
 - lavalamp
 - ericchiang
 - deads2k
-
+- liggitt
+title: Authenticating
 ---
 
+* TOC
+{:toc}
 
 ## Users in Kubernetes
 
@@ -25,16 +28,17 @@ manually through API calls. Service accounts are tied to a set of credentials
 stored as `Secrets`, which are mounted into pods allowing in cluster processes
 to talk to the Kubernetes API.
 
-All API requests are tied to either a normal user or a service account. This
+API requests are tied to either a normal user or a service account, or are treated
-means every process inside or outside the cluster, from a human user typing
+as anonymous requests. This means every process inside or outside the cluster, from 
-`kubectl` on a workstation, to `kubelets` on nodes, to members of the control
+a human user typing `kubectl` on a workstation, to `kubelets` on nodes, to members 
-plane, must authenticate when making requests to the the API server.
+of the control plane, must authenticate when making requests to the API server, 
+or be treated as an anonymous user.
 
 ## Authentication strategies
 
-Kubernetes uses client certificates, bearer tokens, or HTTP basic auth to
+Kubernetes uses client certificates, bearer tokens, an authenticating proxy, or HTTP basic auth to
-authenticate API requests through authentication plugins. As HTTP request are
+authenticate API requests through authentication plugins. As HTTP requests are
-made to the API server plugins attempts to associate the following attributes
+made to the API server, plugins attempt to associate the following attributes
 with the request:
 
 * Username: a string which identifies the end user. Common values might be `kube-admin` or `jane@example.com`.
@@ -54,13 +58,25 @@ When multiple are enabled, the first authenticator module
 to successfully authenticate the request short-circuits evaluation.
 The API server does not guarantee the order authenticators run in.
 
+The `system:authenticated` group is included in the list of groups for all authenticated users. 
+
 ### X509 Client Certs
 
 Client certificate authentication is enabled by passing the `--client-ca-file=SOMEFILE`
 option to API server. The referenced file must contain one or more certificates authorities
 to use to validate client certificates presented to the API server. If a client certificate
 is presented and verified, the common name of the subject is used as the user name for the
-request.
+request. As of Kubernetes 1.4, client certificates can also indicate a user's group memberships
+using the certificate's organization fields. To include multiple group memberships for a user,
+include multiple organization fields in the certificate.
+
+For example, using the `openssl` command line tool to generate a certificate signing request:
+
+``` bash
+openssl req -new -key jbeda.pem -out jbeda-csr.pem -subj "/CN=jbeda/O=app1/O=app2"
+```
+
+This would create a CSR for the username "jbeda", belonging to two groups, "app1" and "app2".
 
 See [APPENDIX](#appendix) for how to generate a client cert.
 
@@ -88,7 +104,7 @@ quoting facilities of HTTP.  For example: if the bearer token is
 header as shown below.
 
 ```http
-Authentication: Bearer 31ada4fd-adec-460c-809a-9e56ceb75269
+Authorization: Bearer 31ada4fd-adec-460c-809a-9e56ceb75269
 ```
 
 ### Static Password File
@@ -347,6 +363,20 @@ An unsuccessful request would return:
 
 HTTP status codes can be used to supply additional error context.
 
+
+### Authenticating Proxy
+
+The API server can be configured to identify users from request header values, such as `X-Remote-User`.
+It is designed for use in combination with an authenticating proxy, which sets the request header value.
+In order to prevent header spoofing, the authenticating proxy is required to present a valid client
+certificate to the API server for validation against the specified CA before the request headers are 
+checked.
+
+* `--requestheader-username-headers` Required, case-insensitive. Header names to check, in order, for the user identity. The first header containing a value is used as the identity.
+* `--requestheader-client-ca-file` Required. PEM-encoded certificate bundle. A valid client certificate must be presented and validated against the certificate authorities in the specified file before the request headers are checked for user names.
+* `--requestheader-allowed-names` Optional.  List of common names (cn). If set, a valid client certificate with a Common Name (cn) in the specified list must be presented before the request headers are checked for user names. If empty, any Common Name is allowed. 
+
+
 ### Keystone Password
 
 Keystone authentication is enabled by passing the `--experimental-keystone-url=<AuthURL>`
@@ -354,6 +384,13 @@ option to the API server during startup. The plugin is implemented in
 `plugin/pkg/auth/authenticator/password/keystone/keystone.go` and currently uses
 basic auth to verify used by username and password.
 
+If you have configured self-signed certificates for the Keystone server,
+you may need to set the `--experimental-keystone-ca-file=SOMEFILE` option when
+starting the Kubernetes API server. If you set the option, the Keystone
+server's certificate is verified by one of the authorities in the
+`experimental-keystone-ca-file`. Otherwise, the certificate is verified by
+the host's root Certificate Authority.
+
 For details on how to use keystone to manage projects and users, refer to the
 [Keystone documentation](http://docs.openstack.org/developer/keystone/). Please
 note that this plugin is still experimental, under active development, and likely
@@ -363,6 +400,22 @@ Please refer to the [discussion](https://github.com/kubernetes/kubernetes/pull/1
 [blueprint](https://github.com/kubernetes/kubernetes/issues/11626) and [proposed
 changes](https://github.com/kubernetes/kubernetes/pull/25536) for more details.
 
+## Anonymous requests
+
+Anonymous access is enabled by default, and can be disabled by passing `--anonymous-auth=false` 
+option to the API server during startup.
+
+When enabled, requests that are not rejected by other configured authentication methods are 
+treated as anonymous requests, and given a username of `system:anonymous` and a group of 
+`system:unauthenticated`.
+
+For example, on a server with token authentication configured, and anonymous access enabled,
+a request providing an invalid bearer token would receive a `401 Unauthorized` error. 
+A request providing no bearer token would be treated as an anonymous request. 
+
+If you rely on authentication alone to authorize access, either change to use an 
+authorization mode other than `AlwaysAllow`, or set `--anonymous-auth=false`.
+
 ## Plugin Development
 
 We plan for the Kubernetes API server to issue tokens after the user has been
@@ -376,7 +429,7 @@ enterprise directory, kerberos, etc.)
 ### Creating Certificates
 
 When using client certificate authentication, you can generate certificates
-using an existing deployment script or manually through `easyrsa` or `openssl.``
+using an existing deployment script or manually through `easyrsa` or `openssl.`
 
 #### Using an Existing Deployment Script
 
@@ -391,7 +444,7 @@ The script will generate three files: `ca.crt`, `server.crt`, and `server.key`.
 Finally, add the following parameters into API server start parameters:
 
 - `--client-ca-file=/srv/kubernetes/ca.crt`
-- `--tls-cert-file=/srv/kubernetes/server.cert`
+- `--tls-cert-file=/srv/kubernetes/server.crt`
 - `--tls-private-key-file=/srv/kubernetes/server.key`
 
 #### easyrsa
@@ -415,7 +468,7 @@ Finally, add the following parameters into API server start parameters:
 1.  Fill in and add the following parameters into the API server start parameters:
 
           --client-ca-file=/yourdirectory/ca.crt
-          --tls-cert-file=/yourdirectory/server.cert
+          --tls-cert-file=/yourdirectory/server.crt
           --tls-private-key-file=/yourdirectory/server.key
 
 #### openssl

docs/admin/authorization.md

@@ -2,7 +2,9 @@
 assignees:
 - erictune
 - lavalamp
-
+- deads2k
+- liggitt
+title: Using Authorization Plugins
 ---
 
 In Kubernetes, authorization happens as a separate step from authentication.
@@ -53,7 +55,7 @@ A request has the following attributes that can be considered for authorization:
   - what resource is being accessed (for resource requests only)
   - what subresource is being accessed (for resource requests only)
   - the namespace of the object being accessed (for namespaced resource requests only)
-  - the API group being accessed (for resource requests only)
+  - the API group being accessed (for resource requests only); an empty string designates the [core API group](../api.md#api-groups)
 
 The request verb for a resource API endpoint can be determined by the HTTP verb used and whether or not the request acts on an individual resource or a collection of resources:
 
@@ -207,6 +209,29 @@ and [enable the API version](
 /docs/admin/cluster-management/#turn-on-or-off-an-api-version-for-your-cluster),
 with a `--runtime-config=` that includes `rbac.authorization.k8s.io/v1alpha1`.
 
+### Privilege Escalation Prevention and Bootstrapping
+
+The `rbac.authorization.k8s.io` API group inherently attempts to prevent users
+from escalating privileges. Simply put, __a user can't grant permissions they
+don't already have even when the RBAC authorizer it disabled__. If "user-1"
+does not have the ability to read secrets in "namespace-a", they cannot create
+a binding that would grant that permission to themselves or any other user.
+
+For bootstrapping the first roles, it becomes necessary for someone to get
+around these limitations. For the alpha release of RBAC, an API Server flag was
+added to allow one user to step around all RBAC authorization and privilege
+escalation checks. NOTE: _This is subject to change with future releases._
+
+```
+--authorization-rbac-super-user=admin
+```
+
+Once set the specified super user, in this case "admin", can be used to create
+the roles and role bindings to initialize the system.
+
+This flag is optional and once the initial bootstrapping is performed can be
+unset.
+
 ### Roles, RolesBindings, ClusterRoles, and ClusterRoleBindings
 
 The RBAC API Group declares four top level types which will be covered in this
@@ -231,7 +256,7 @@ metadata:
   namespace: default
   name: pod-reader
 rules:
-  - apiGroups: [""] # The API group "" indicates the default API Group.
+  - apiGroups: [""] # The API group "" indicates the core API Group.
     resources: ["pods"]
     verbs: ["get", "watch", "list"]
     nonResourceURLs: []
@@ -274,9 +299,8 @@ subjects:
     name: jane
 roleRef:
   kind: Role
-  namespace: default
   name: pod-reader
-  apiVersion: rbac.authorization.k8s.io/v1alpha1
+  apiGroup: rbac.authorization.k8s.io
 ```
 
 `RoleBindings` may also refer to a `ClusterRole`. However, a `RoleBinding` that
@@ -301,26 +325,52 @@ subjects:
 roleRef:
   kind: ClusterRole
   name: secret-reader
-  apiVersion: rbac.authorization.k8s.io/v1alpha1
+  apiGroup: rbac.authorization.k8s.io
 ```
 
 Finally a `ClusterRoleBinding` may be used to grant permissions in all
 namespaces. The following `ClusterRoleBinding` allows any user in the group
-"manager" to read secrets in any namepsace.
+"manager" to read secrets in any namespace.
 
 ```yaml
 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace.
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1alpha1
 metadata:
-  name: read-secrets
+  name: read-secrets-global
 subjects:
   - kind: Group # May be "User", "Group" or "ServiceAccount"
     name: manager
 roleRef:
   kind: ClusterRole
-  name: secret-reader
+  name: secret-reader
-  apiVersion: rbac.authorization.k8s.io/v1alpha1
+  apiGroup: rbac.authorization.k8s.io
+```
+
+### Referring to Resources
+
+Most resources are represented by a string representation of their name, such as "pods", just as it
+appears in the URL for the relevant API endpoint. However, some Kubernetes APIs involve a
+"subresource" such as the logs for a pod. The URL for the pods logs endpoint is:
+
+```
+GET /api/v1/namespaces/{namespace}/pods/{name}/log
+```
+
+In this case, "pods" is the namespaced resource, and "log" is a subresource of pods. To represent
+this in an RBAC role, use a slash to delimit the resource and subresource names. To allow a subject
+to read both pods and pod logs, you would write:
+
+```yaml
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1alpha1
+metadata:
+  namespace: default
+  name: pod-and-pod-logs-reader
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list"]
 ```
 
 ### Referring to Subjects
@@ -351,6 +401,7 @@ to groups with the `system:` prefix.
 Only the `subjects` section of a RoleBinding object shown in the following examples.
 
 For a user called `alice@example.com`, specify
+
 ```yaml
 subjects:
   - kind: User
@@ -358,6 +409,7 @@ subjects:
 ```
 
 For a group called `frontend-admins`, specify:
+
 ```yaml
 subjects:
   - kind: Group
@@ -365,6 +417,7 @@ subjects:
 ```
 
 For the default service account in the kube-system namespace:
+
 ```yaml
 subjects:
  - kind: ServiceAccount
@@ -373,6 +426,7 @@ subjects:
 ```
 
 For all service accounts in the `qa` namespace:
+
 ```yaml
 subjects:
 - kind: Group
@@ -380,35 +434,13 @@ subjects:
 ```
 
 For all service accounts everywhere:
+
 ```yaml
 subjects:
 - kind: Group
   name: system:serviceaccounts
 ```
 
-### Privilege Escalation Prevention and Bootstrapping
-
-The `rbac.authorization.k8s.io` API group inherently attempts to prevent users
-from escalating privileges. Simply put, __a user can't grant permissions they
-don't already have even when the RBAC authorizer it disabled__. If "user-1"
-does not have the ability to read secrets in "namespace-a", they cannot create
-a binding that would grant that permission to themselves or any other user.
-
-For bootstrapping the first roles, it becomes necessary for someone to get
-around these limitations. For the alpha release of RBAC, an API Server flag was
-added to allow one user to step around all RBAC authorization and privilege
-escalation checks. NOTE: _This is subject to change with future releases._
-
-```
---authorization-rbac-super-user=admin
-```
-
-Once set the specified super user, in this case "admin", can be used to create
-the roles and role bindings to initialize the system.
-
-This flag is optional and once the initial bootstrapping is performed can be
-unset.
-
 ## Webhook Mode
 
 When specified, mode `Webhook` causes Kubernetes to query an outside REST
@@ -534,10 +566,10 @@ Access to non-resource paths are sent as:
 
 Non-resource paths include: `/api`, `/apis`, `/metrics`, `/resetMetrics`,
 `/logs`, `/debug`, `/healthz`, `/swagger-ui/`, `/swaggerapi/`, `/ui`, and
-`/version.` Clients require access to `/api`, `/api/*/`, `/apis/`, `/apis/*`,
+`/version.` Clients require access to `/api`, `/api/*`, `/apis`, `/apis/*`,
-`/apis/*/*`, and `/version` to discover what resources and versions are present
+and `/version` to discover what resources and versions are present on the server.
-on the server. Access to other non-resource paths can be disallowed without
+Access to other non-resource paths can be disallowed without restricting access
-restricting access to the REST api.
+to the REST api.
 
 For further documentation refer to the authorization.v1beta1 API objects and
 plugin/pkg/auth/authorizer/webhook/webhook.go.

docs/admin/cluster-components.md

@@ -1,7 +1,7 @@
 ---
 assignees:
 - lavalamp
-
+title: Kubernetes Components
 ---
 
 This document outlines the various binary components that need to run to
@@ -61,12 +61,12 @@ selects a node for them to run on.
 
 ### addons
 
-Addons are pods and services that implement cluster features. They don't run on
+Addons are pods and services that implement cluster features. The pods may be managed
-the master VM, but currently the default setup scripts that make the API calls
+by Deployments, ReplicationContollers, etc. Namespaced addon objects are created in
-to create these pods and services does run on the master VM. See:
+the "kube-system" namespace.
-[kube-master-addons](http://releases.k8s.io/HEAD/cluster/saltbase/salt/kube-master-addons/kube-master-addons.sh)
 
-Addon objects are created in the "kube-system" namespace.
+Addon manager takes the responsibility for creating and maintaining addon resources.
+See [here](http://releases.k8s.io/HEAD/cluster/addons) for more details.
 
 #### DNS
 

docs/admin/cluster-large.md

@@ -2,10 +2,9 @@
 assignees:
 - davidopp
 - lavalamp
-
+title: Building Large Clusters
 ---
 
-
 ## Support
 
 At {{page.version}}, Kubernetes supports clusters with up to 1000 nodes. More specifically, we support configurations that meet *all* of the following criteria:

docs/admin/cluster-management.md

@@ -2,7 +2,7 @@
 assignees:
 - lavalamp
 - thockin
-
+title: Cluster Management Guide
 ---
 
 * TOC
@@ -92,16 +92,16 @@ an extended period of time (10min but it may change in the future).
 Cluster autoscaler is configured per instance group (GCE) or node pool (GKE).
 
 If you are using GCE then you can either enable it while creating a cluster with kube-up.sh script. 
-To configure cluser autoscaler you have to set 3 environment variables:
+To configure cluster autoscaler you have to set 3 environment variables:
 
 * `KUBE_ENABLE_CLUSTER_AUTOSCALER` - it enables cluster autoscaler if set to true.
-* `KUBE_AUTOSCALING_MIN_NODES` - minimum number of nodes in the cluster.
+* `KUBE_AUTOSCALER_MIN_NODES` - minimum number of nodes in the cluster.
-* `KUBE_AUTOSCALING_MAX_NODES` - maximum number of nodes in the cluster.
+* `KUBE_AUTOSCALER_MAX_NODES` - maximum number of nodes in the cluster.
 
 Example:
 
 ```shell
-KUBE_ENABLE_CLUSTER_AUTOSCALER=true KUBE_AUTOSCALING_MIN_NODES=3 KUBE_AUTOSCALING_MAX_NODES=10 NUM_NODES=5 ./cluster/kube-up.sh
+KUBE_ENABLE_CLUSTER_AUTOSCALER=true KUBE_AUTOSCALER_MIN_NODES=3 KUBE_AUTOSCALER_MAX_NODES=10 NUM_NODES=5 ./cluster/kube-up.sh
 ```
 
 On GKE you configure cluster autoscaler either on cluster creation or update or when creating a particular node pool
@@ -180,7 +180,7 @@ For the purposes of these flags, _legacy_ APIs are those APIs which have been ex
 
 The objects that are stored to disk for a cluster's internal representation of the Kubernetes resources active in the cluster are written using a particular version of the API.
 When the supported API changes, these objects may need to be rewritten in the newer API.  Failure to do this will eventually result in resources that are no longer decodable or usable
-by the kubernetes API server.
+by the Kubernetes API server.
 
 `KUBE_API_VERSIONS` environment variable for the `kube-apiserver` binary which controls the API versions that are supported in the cluster. The first version in the list is used as the cluster's storage version. Hence, to set a specific version as the storage version, bring it to the front of list of versions in the value of `KUBE_API_VERSIONS`.  You need to restart the `kube-apiserver` binary
 for changes to this variable to take effect.

docs/admin/cluster-troubleshooting.md

@@ -1,7 +1,7 @@
 ---
 assignees:
 - davidopp
-
+title: Troubleshooting Clusters
 ---
 
 This doc is about cluster troubleshooting; we assume you have already ruled out your application as the root cause of the
@@ -89,7 +89,7 @@ Mitigations:
   - Mitigates: Apiserver VM shutdown or apiserver crashing
   - Mitigates: Supporting services VM shutdown or crashes
 
-- Action use IaaS providers reliable storage (e.g GCE PD or AWS EBS volume) for VMs with apiserver+etcd
+- Action use IaaS providers reliable storage (e.g. GCE PD or AWS EBS volume) for VMs with apiserver+etcd
   - Mitigates: Apiserver backing storage lost
 
 - Action: Use (experimental) [high-availability](/docs/admin/high-availability) configuration

docs/admin/daemons.md

@@ -1,26 +1,26 @@
 ---
 assignees:
 - erictune
-
+title: Daemon Sets
 ---
 
 * TOC
 {:toc}
 
-## What is a _Daemon Set_?
+## What is a DaemonSet?
 
-A _Daemon Set_ ensures that all (or some) nodes run a copy of a pod.  As nodes are added to the
+A _DaemonSet_ ensures that all (or some) nodes run a copy of a pod.  As nodes are added to the
 cluster, pods are added to them.  As nodes are removed from the cluster, those pods are garbage
-collected.  Deleting a Daemon Set will clean up the pods it created.
+collected.  Deleting a DaemonSet will clean up the pods it created.
 
-Some typical uses of a Daemon Set are:
+Some typical uses of a DaemonSet are:
 
 - running a cluster storage daemon, such as `glusterd`, `ceph`, on each node.
 - running a logs collection daemon on every node, such as `fluentd` or `logstash`.
 - running a node monitoring daemon on every node, such as [Prometheus Node Exporter](
   https://github.com/prometheus/node_exporter), `collectd`, New Relic agent, or Ganglia `gmond`.
 
-In a simple case, one Daemon Set, covering all nodes, would be used for each type of daemon.
+In a simple case, one DaemonSet, covering all nodes, would be used for each type of daemon.
 A more complex setup might use multiple DaemonSets would be used for a single type of daemon,
 but with different flags and/or different memory and cpu requests for different hardware types.
 
@@ -74,7 +74,7 @@ a node for testing.
 
 If you specify a `.spec.template.spec.nodeSelector`, then the DaemonSet controller will
 create pods on nodes which match that [node
-selector](https://github.com/kubernetes/kubernetes.github.io/tree/{{page.docsbranch}}/docs/user-guide/node-selection).  
+selector](/docs/user-guide/node-selection/).
 If you specify a `scheduler.alpha.kubernetes.io/affinity` annotation in `.spec.template.metadata.annotations`,
 then DaemonSet controller will create pods on nodes which match that [node affinity](../../user-guide/node-selection/#alpha-feature-in-kubernetes-v12-node-affinity).
 
@@ -88,18 +88,17 @@ created by the Daemon controller have the machine already selected (`.spec.nodeN
 when the pod is created, so it is ignored by the scheduler).  Therefore:
 
  - the [`unschedulable`](/docs/admin/node/#manual-node-administration) field of a node is not respected
-   by the daemon set controller.
+   by the DaemonSet controller.
- - daemon set controller can make pods even when the scheduler has not been started, which can help cluster
+ - DaemonSet controller can make pods even when the scheduler has not been started, which can help cluster
    bootstrap.
 
 ## Communicating with DaemonSet Pods
 
 Some possible patterns for communicating with pods in a DaemonSet are:
 
-- **Push**: Pods in the Daemon Set are configured to send updates to another service, such
+- **Push**: Pods in the DaemonSet are configured to send updates to another service, such
   as a stats database.  They do not have clients.
-- **NodeIP and Known Port**: Pods in the Daemon Set use a `hostPort`, so that the pods are reachable
+- **NodeIP and Known Port**: Pods in the DaemonSet use a `hostPort`, so that the pods are reachable via the node IPs.  Clients know the list of nodes ips somehow, and know the port by convention.
-  via the node IPs.  Clients knows the the list of nodes ips somehow, and know the port by convention.
 - **DNS**: Create a [headless service](/docs/user-guide/services/#headless-services) with the same pod selector,
   and then discover DaemonSets using the `endpoints` resource or retrieve multiple A records from
   DNS.
@@ -126,11 +125,11 @@ You cannot update a DaemonSet.
 
 Support for updating DaemonSets and controlled updating of nodes is planned.
 
-## Alternatives to Daemon Set
+## Alternatives to DaemonSet
 
 ### Init Scripts
 
-It is certainly possible to run daemon processes by directly starting them on a node (e.g using
+It is certainly possible to run daemon processes by directly starting them on a node (e.g. using
 `init`, `upstartd`, or `systemd`).  This is perfectly fine.  However, there are several advantages to
 running such processes via a DaemonSet:
 
@@ -145,9 +144,9 @@ running such processes via a DaemonSet:
 ### Bare Pods
 
 It is possible to create pods directly which specify a particular node to run on.  However,
-a Daemon Set replaces pods that are deleted or terminated for any reason, such as in the case of
+a DaemonSet replaces pods that are deleted or terminated for any reason, such as in the case of
 node failure or disruptive node maintenance, such as a kernel upgrade. For this reason, you should
-use a Daemon Set rather than creating individual pods.
+use a DaemonSet rather than creating individual pods.
 
 ### Static Pods
 
@@ -159,7 +158,7 @@ in cluster bootstrapping cases.  Also, static pods may be deprecated in the futu
 
 ### Replication Controller
 
-Daemon Set are similar to [Replication Controllers](/docs/user-guide/replication-controller) in that
+DaemonSet are similar to [Replication Controllers](/docs/user-guide/replication-controller) in that
 they both create pods, and those pods have processes which are not expected to terminate (e.g. web servers,
 storage servers).
 

docs/admin/disruptions.md

@@ -1,7 +1,7 @@
 ---
 assignees:
-- mml
+- davidopp
-
+title: Pod Disruption Budget
 ---
 This guide is for anyone wishing to specify safety constraints on pods or anyone
 wishing to write software (typically automation software) that respects those
@@ -59,19 +59,19 @@ itself.  To attempt an eviction (perhaps more REST-precisely, to attempt to
 
 ```json
 {
-  "apiVersion": "policy/v1alpha1",
+  "apiVersion": "policy/v1beta1",
   "kind": "Eviction",
-  "name": "quux",
+  "metadata": {
-  "namespace": "default"
+    "name": "quux",
+    "namespace": "default"
+  }
 }
 ```
 
-and here is how you would attempt this with `curl`
+You can attempt an eviction using `curl`:
 
 ```bash
-curl -v -X POST -H 'Content-type: application/json'
+$ curl -v -H 'Content-type: application/json' http://127.0.0.1:8080/api/v1/namespaces/default/pods/quux/eviction -d @eviction.json
-http://127.0.0.1:8080/api/v1/namespaces/default/pods/quux/eviction -d
-eviction.json
 ```
 
 The API can respond in one of three ways.

docs/admin/dns.md

@@ -3,16 +3,20 @@ assignees:
 - ArtfulCoder
 - davidopp
 - lavalamp
-
+title: Using DNS Pods and Services
 ---
 
 ## Introduction
 
 As of Kubernetes 1.3, DNS is a built-in service launched automatically using the addon manager [cluster add-on](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/README.md).
-A DNS Pod and Service will be scheduled on the cluster, and the kubelets will be
-configured to tell individual containers to use the DNS Service's IP to resolve DNS names.
 
-Every Service defined in the cluster (including the DNS server itself) will be
+Kubernetes DNS schedules a DNS Pod and Service on the cluster, and configures
+the kubelets to tell individual containers to use the DNS Service's IP to
+resolve DNS names.
+
+## What things get DNS names?
+
+Every Service defined in the cluster (including the DNS server itself) is
 assigned a DNS name.  By default, a client Pod's DNS search list will
 include the Pod's own namespace and the cluster's default domain.  This is best
 illustrated by example:
@@ -22,17 +26,304 @@ in namespace `bar` can look up this service by simply doing a DNS query for
 `foo`.  A Pod running in namespace `quux` can look up this service by doing a
 DNS query for `foo.bar`.
 
-The Kubernetes cluster DNS server (based off the [SkyDNS](https://github.com/skynetservices/skydns) library)
+## Supported DNS schema
-supports forward lookups (A records), service lookups (SRV records) and reverse IP address lookups (PTR records).
 
+The following sections detail the supported record types and layout that is
+supported.  Any other layout or names or queries that happen to work are
+considered implementation details and are subject to change without warning.
 
-## How it Works
+### Services
 
-The running Kubernetes DNS pod holds 3 containers - kubedns, dnsmasq and a health check called healthz.
+#### A records
-The kubedns process watches the Kubernetes master for changes in Services and Endpoints, and maintains
+
-in-memory lookup structures to service DNS requests. The dnsmasq container adds DNS caching to improve
+"Normal" (not headless) Services are assigned a DNS A record for a name of the
-performance. The healthz container provides a single health check endpoint while performing dual healthchecks
+form `my-svc.my-namespace.svc.cluster.local`.  This resolves to the cluster IP
-(for dnsmasq and kubedns).
+of the Service.
+
+"Headless" (without a cluster IP) Services are also assigned a DNS A record for
+a name of the form `my-svc.my-namespace.svc.cluster.local`.  Unlike normal
+Services, this resolves to the set of IPs of the pods selected by the Service.
+Clients are expected to consume the set or else use standard round-robin
+selection from the set.
+
+### SRV records
+
+SRV Records are created for named ports that are part of normal or Headless
+Services.
+For each named port, the SRV record would have the form
+`_my-port-name._my-port-protocol.my-svc.my-namespace.svc.cluster.local`.
+For a regular service, this resolves to the port number and the CNAME:
+`my-svc.my-namespace.svc.cluster.local`.
+For a headless service, this resolves to multiple answers, one for each pod
+that is backing the service, and contains the port number and a CNAME of the pod
+of the form `auto-generated-name.my-svc.my-namespace.svc.cluster.local`.
+
+### Backwards compatibility
+
+Previous versions of kube-dns made names of the form
+`my-svc.my-namespace.cluster.local` (the 'svc' level was added later).  This
+is no longer supported.
+
+### Pods
+
+#### A Records
+
+When enabled, pods are assigned a DNS A record in the form of `pod-ip-address.my-namespace.pod.cluster.local`.
+
+For example, a pod with ip `1.2.3.4` in the namespace `default` with a DNS name of `cluster.local` would have an entry: `1-2-3-4.default.pod.cluster.local`.
+
+#### A Records and hostname based on Pod's hostname and subdomain fields
+
+Currently when a pod is created, its hostname is the Pod's `metadata.name` value.
+
+With v1.2, users can specify a Pod annotation, `pod.beta.kubernetes.io/hostname`, to specify what the Pod's hostname should be.
+The Pod annotation, if specified, takes precedence over the Pod's name, to be the hostname of the pod.
+For example, given a Pod with annotation `pod.beta.kubernetes.io/hostname: my-pod-name`, the Pod will have its hostname set to "my-pod-name".
+
+With v1.3, the PodSpec has a `hostname` field, which can be used to specify the Pod's hostname. This field value takes precedence over the
+`pod.beta.kubernetes.io/hostname` annotation value.
+
+v1.2 introduces a beta feature where the user can specify a Pod annotation, `pod.beta.kubernetes.io/subdomain`, to specify the Pod's subdomain.
+The final domain will be "<hostname>.<subdomain>.<pod namespace>.svc.<cluster domain>".
+For example, a Pod with the hostname annotation set to "foo", and the subdomain annotation set to "bar", in namespace "my-namespace", will have the FQDN "foo.bar.my-namespace.svc.cluster.local"
+
+With v1.3, the PodSpec has a `subdomain` field, which can be used to specify the Pod's subdomain. This field value takes precedence over the
+`pod.beta.kubernetes.io/subdomain` annotation value.
+
+Example:
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: default-subdomain
+spec:
+  selector:
+    name: busybox
+  clusterIP: None
+  ports:
+    - name: foo # Actually, no port is needed.
+      port: 1234 
+      targetPort: 1234
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: busybox1
+  labels:
+    name: busybox
+spec:
+  hostname: busybox-1
+  subdomain: default-subdomain
+  containers:
+  - image: busybox
+    command:
+      - sleep
+      - "3600"
+    name: busybox
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: busybox2
+  labels:
+    name: busybox
+spec:
+  hostname: busybox-2
+  subdomain: default-subdomain
+  containers:
+  - image: busybox
+    command:
+      - sleep
+      - "3600"
+    name: busybox
+```
+
+If there exists a headless service in the same namespace as the pod and with the same name as the subdomain, the cluster's KubeDNS Server also returns an A record for the Pod's fully qualified hostname.
+Given a Pod with the hostname set to "busybox-1" and the subdomain set to "default-subdomain", and a headless Service named "default-subdomain" in the same namespace, the pod will see it's own FQDN as "busybox-1.default-subdomain.my-namespace.svc.cluster.local". DNS serves an A record at that name, pointing to the Pod's IP. Both pods "busybox1" and "busybox2" can have their distinct A records. 
+
+As of Kubernetes v1.2, the Endpoints object also has the annotation `endpoints.beta.kubernetes.io/hostnames-map`. Its value is the json representation of map[string(IP)][endpoints.HostRecord], for example: '{"10.245.1.6":{HostName: "my-webserver"}}'.
+If the Endpoints are for a headless service, an A record is created with the format <hostname>.<service name>.<pod namespace>.svc.<cluster domain>
+For the example json, if endpoints are for a headless service named "bar", and one of the endpoints has IP "10.245.1.6", an A record is created with the name "my-webserver.bar.my-namespace.svc.cluster.local" and the A record lookup would return "10.245.1.6".
+This endpoints annotation generally does not need to be specified by end-users, but can used by the internal service controller to deliver the aforementioned feature.
+
+With v1.3, The Endpoints object can specify the `hostname` for any endpoint, along with its IP. The hostname field takes precedence over the hostname value
+that might have been specified via the  `endpoints.beta.kubernetes.io/hostnames-map` annotation.
+
+With v1.3, the following annotations are deprecated: `pod.beta.kubernetes.io/hostname`, `pod.beta.kubernetes.io/subdomain`, `endpoints.beta.kubernetes.io/hostnames-map`
+
+## How do I test if it is working?
+
+### Create a simple Pod to use as a test environment
+
+Create a file named busybox.yaml with the
+following contents:
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: busybox
+  namespace: default
+spec:
+  containers:
+  - image: busybox
+    command:
+      - sleep
+      - "3600"
+    imagePullPolicy: IfNotPresent
+    name: busybox
+  restartPolicy: Always
+```
+
+Then create a pod using this file:
+
+```
+kubectl create -f busybox.yaml
+```
+
+### Wait for this pod to go into the running state
+
+You can get its status with:
+```
+kubectl get pods busybox
+```
+
+You should see:
+
+```
+NAME      READY     STATUS    RESTARTS   AGE
+busybox   1/1       Running   0          <some-time>
+```
+
+### Validate that DNS is working
+
+Once that pod is running, you can exec nslookup in that environment:
+
+```
+kubectl exec -ti busybox -- nslookup kubernetes.default
+```
+
+You should see something like:
+
+```
+Server:    10.0.0.10
+Address 1: 10.0.0.10
+
+Name:      kubernetes.default
+Address 1: 10.0.0.1
+```
+
+If you see that, DNS is working correctly.
+
+### Troubleshooting Tips
+
+If the nslookup command fails, check the following:
+
+#### Check the local DNS configuration first
+Take a look inside the resolv.conf file. (See "Inheriting DNS from the node" and "Known issues" below for more information)
+
+```
+kubectl exec busybox cat /etc/resolv.conf
+```
+
+Verify that the search path and name server are set up like the following (note that search path may vary for different cloud providers):
+
+```
+search default.svc.cluster.local svc.cluster.local cluster.local google.internal c.gce_project_id.internal
+nameserver 10.0.0.10
+options ndots:5
+```
+
+#### Quick diagnosis
+
+Errors such as the following indicate a problem with the kube-dns add-on or associated Services:
+
+```
+$ kubectl exec -ti busybox -- nslookup kubernetes.default
+Server:    10.0.0.10
+Address 1: 10.0.0.10
+
+nslookup: can't resolve 'kubernetes.default'
+```
+
+or
+
+```
+$ kubectl exec -ti busybox -- nslookup kubernetes.default
+Server:    10.0.0.10
+Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local
+
+nslookup: can't resolve 'kubernetes.default'
+```
+
+#### Check if the DNS pod is running
+
+Use the kubectl get pods command to verify that the DNS pod is running.
+
+```
+kubectl get pods --namespace=kube-system -l k8s-app=kube-dns
+```
+
+You should see something like:
+
+```
+NAME                                                       READY     STATUS    RESTARTS   AGE
+...
+kube-dns-v19-ezo1y                                         3/3       Running   0           1h
+...
+```
+
+If you see that no pod is running or that the pod has failed/completed, the DNS add-on may not be deployed by default in your current environment and you will have to deploy it manually.
+
+#### Check for Errors in the DNS pod
+
+Use `kubectl logs` command to see logs for the DNS daemons.
+
+```
+kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name) -c kube-dns
+kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name) -c dnsmasq
+kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name) -c healthz
+```
+
+See if there is any suspicious log. W, E, F letter at the beginning represent Warning, Error and Failure. Please search for entries that have these as the logging level and use [kubernetes issues](https://github.com/kubernetes/kubernetes/issues) to report unexpected errors.
+
+#### Is DNS service up?
+
+Verify that the DNS service is up by using the `kubectl get service` command.
+
+```
+kubectl get svc --namespace=kube-system
+```
+
+You should see:
+
+```
+NAME                    CLUSTER-IP     EXTERNAL-IP   PORT(S)             AGE
+...
+kube-dns                10.0.0.10      <none>        53/UDP,53/TCP        1h
+...
+```
+
+If you have created the service or in the case it should be created by default but it does not appear, see this [debugging services page](http://kubernetes.io/docs/user-guide/debugging-services/) for more information.
+
+#### Are DNS endpoints exposed?
+
+You can verify that dns endpoints are exposed by using the `kubectl get endpoints` command.
+
+```
+kubectl get ep kube-dns --namespace=kube-system
+```
+
+You should see something like:
+```
+NAME       ENDPOINTS                       AGE
+kube-dns   10.180.3.17:53,10.180.3.17:53    1h
+```
+
+If you do not see the endpoints, see endpoints section in the [debugging services documentation](http://kubernetes.io/docs/user-guide/debugging-services/).
+
+For additional Kubernetes DNS examples, see the [cluster-dns examples](https://github.com/kubernetes/kubernetes/tree/master/examples/cluster-dns) in the Kubernetes GitHub repository.
 
 ## Kubernetes Federation (Multiple Zone support)
 
@@ -44,7 +335,56 @@ the lookup of federated services (which span multiple Kubernetes clusters).
 See the [Cluster Federation Administrators' Guide](/docs/admin/federation) for more
 details on Cluster Federation and multi-site support.
 
+## How it Works
+
+The running Kubernetes DNS pod holds 3 containers - kubedns, dnsmasq and a health check called healthz.
+The kubedns process watches the Kubernetes master for changes in Services and Endpoints, and maintains
+in-memory lookup structures to service DNS requests. The dnsmasq container adds DNS caching to improve
+performance. The healthz container provides a single health check endpoint while performing dual healthchecks
+(for dnsmasq and kubedns).
+
+The DNS pod is exposed as a Kubernetes Service with a static IP. Once assigned the
+kubelet passes DNS configured using the `--cluster-dns=10.0.0.10` flag to each
+container.
+
+DNS names also need domains. The local domain is configurable, in the kubelet using
+the flag `--cluster-domain=<default local domain>`
+
+The Kubernetes cluster DNS server (based off the [SkyDNS](https://github.com/skynetservices/skydns) library)
+supports forward lookups (A records), service lookups (SRV records) and reverse IP address lookups (PTR records).
+
+## Inheriting DNS from the node
+When running a pod, kubelet will prepend the cluster DNS server and search
+paths to the node's own DNS settings.  If the node is able to resolve DNS names
+specific to the larger environment, pods should be able to, also.  See "Known
+issues" below for a caveat.
+
+If you don't want this, or if you want a different DNS config for pods, you can
+use the kubelet's `--resolv-conf` flag.  Setting it to "" means that pods will
+not inherit DNS.  Setting it to a valid file path means that kubelet will use
+this file instead of `/etc/resolv.conf` for DNS inheritance.
+
+## Known issues
+Kubernetes installs do not configure the nodes' resolv.conf files to use the
+cluster DNS by default, because that process is inherently distro-specific.
+This should probably be implemented eventually.
+
+Linux's libc is impossibly stuck ([see this bug from
+2005](https://bugzilla.redhat.com/show_bug.cgi?id=168253)) with limits of just
+3 DNS `nameserver` records and 6 DNS `search` records.  Kubernetes needs to
+consume 1 `nameserver` record and 3 `search` records.  This means that if a
+local installation already uses 3 `nameserver`s or uses more than 3 `search`es,
+some of those settings will be lost.  As a partial workaround, the node can run
+`dnsmasq` which will provide more `nameserver` entries, but not more `search`
+entries.  You can also use kubelet's `--resolv-conf` flag.
+
+If you are using Alpine version 3.3 or earlier as your base image, DNS may not
+work properly owing to a known issue with Alpine. Check [here](https://github.com/kubernetes/kubernetes/issues/30215)
+for more information.
+
 ## References
 
-- [Docs for the DNS cluster addon](http://releases.k8s.io/{{page.githubbranch}}/build/kube-dns/README.md)
+- [Docs for the DNS cluster addon](http://releases.k8s.io/{{page.githubbranch}}/build-tools/kube-dns/README.md)
 
+## What's next
+- [Autoscaling the DNS Service in a Cluster](/docs/tasks/administer-cluster/dns-horizontal-autoscaling/).

docs/admin/etcd.md

@@ -1,10 +1,9 @@
 ---
 assignees:
 - lavalamp
-
+title: Configuring Kubernetes Use of etcd
 ---
 
-
 [etcd](https://coreos.com/etcd/docs/2.2.1/) is a highly-available key value
 store which Kubernetes uses for persistent storage of all of its REST API
 objects.

docs/admin/federation-apiserver.md

@@ -1,4 +1,6 @@
 ---
+title: federation-apiserver
+notitle: true
 ---
 
 ## federation-apiserver
@@ -20,10 +22,11 @@ federation-apiserver
 ### Options
 
 ```
-      --admission-control string                                Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, NamespaceLifecycle. (default "AlwaysAdmit")
+      --admission-control string                                Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, NamespaceLifecycle, OwnerReferencesPermissionEnforcement. (default "AlwaysAdmit")
       --admission-control-config-file string                    File with admission control configuration.
-      --advertise-address value                                 The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.
+      --advertise-address ip                                    The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.
-      --apiserver-count int                                     The number of apiservers running in the cluster. (default 1)
+      --anonymous-auth                                          Enables anonymous requests to the secure port of the API server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated. (default true)
+      --apiserver-count int                                     The number of apiservers running in the cluster. Must be a positive number. (default 1)
       --audit-log-maxage int                                    The maximum number of days to retain old audit log files based on the timestamp encoded in their filename.
       --audit-log-maxbackup int                                 The maximum number of old audit log files to retain.
       --audit-log-maxsize int                                   The maximum size in megabytes of the audit log file before it gets rotated. Defaults to 100MB.
@@ -35,64 +38,71 @@ federation-apiserver
       --authorization-webhook-cache-unauthorized-ttl duration   The duration to cache 'unauthorized' responses from the webhook authorizer. Default is 30s. (default 30s)
       --authorization-webhook-config-file string                File with webhook configuration in kubeconfig format, used with --authorization-mode=Webhook. The API server will query the remote service to determine access on the API server's secure port.
       --basic-auth-file string                                  If set, the file that will be used to admit requests to the secure port of the API server via http basic authentication.
-      --bind-address value                                      The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank, all interfaces will be used (0.0.0.0). (default 0.0.0.0)
+      --bind-address ip                                         The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank, all interfaces will be used (0.0.0.0). (default 0.0.0.0)
       --cert-dir string                                         The directory where the TLS certs are located (by default /var/run/kubernetes). If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored. (default "/var/run/kubernetes")
       --client-ca-file string                                   If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.
       --cloud-config string                                     The path to the cloud provider configuration file. Empty string for no configuration file.
       --cloud-provider string                                   The provider for cloud services. Empty string for no provider.
-      --cors-allowed-origins value                              List of allowed origins for CORS, comma separated.  An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled. (default [])
+      --contention-profiling                                    Enable contention profiling. Requires --profiling to be set to work.
+      --cors-allowed-origins stringSlice                        List of allowed origins for CORS, comma separated.  An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled.
       --delete-collection-workers int                           Number of workers spawned for DeleteCollection call. These are used to speed up namespace cleanup. (default 1)
-      --deserialization-cache-size int                          Number of deserialized json objects to cache in memory. (default 50000)
+      --deserialization-cache-size int                          Number of deserialized json objects to cache in memory.
+      --enable-garbage-collector                                Enables the generic garbage collector. MUST be synced with the corresponding flag of the kube-controller-manager. (default true)
       --enable-swagger-ui                                       Enables swagger ui on the apiserver at /swagger-ui
       --etcd-cafile string                                      SSL Certificate Authority file used to secure etcd communication.
       --etcd-certfile string                                    SSL certification file used to secure etcd communication.
       --etcd-keyfile string                                     SSL key file used to secure etcd communication.
       --etcd-prefix string                                      The prefix for all resource paths in etcd. (default "/registry")
       --etcd-quorum-read                                        If true, enable quorum read.
-      --etcd-servers value                                      List of etcd servers to connect with (http://ip:port), comma separated. (default [])
+      --etcd-servers stringSlice                                List of etcd servers to connect with (scheme://ip:port), comma separated.
-      --etcd-servers-overrides value                            Per-resource etcd servers overrides, comma separated. The individual override format: group/resource#servers, where servers are http://ip:port, semicolon separated. (default [])
+      --etcd-servers-overrides stringSlice                      Per-resource etcd servers overrides, comma separated. The individual override format: group/resource#servers, where servers are http://ip:port, semicolon separated.
       --event-ttl duration                                      Amount of time to retain events. Default is 1h. (default 1h0m0s)
+      --experimental-keystone-ca-file string                    If set, the Keystone server's certificate will be verified by one of the authorities in the experimental-keystone-ca-file, otherwise the host's root CA set will be used.
       --experimental-keystone-url string                        If passed, activates the keystone authentication plugin.
       --external-hostname string                                The hostname to use when generating externalized URLs for this master (e.g. Swagger API Docs).
-      --feature-gates value                                     A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --feature-gates mapStringBool                             A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
 AllAlpha=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
 AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
-      --insecure-bind-address value                             The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all interfaces). Defaults to localhost. (default 127.0.0.1)
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
+StreamingProxyRedirects=true|false (ALPHA - default=false)
+      --insecure-allow-any-token username/group1,group2         If set, your server will be INSECURE.  Any token will be allowed and user information will be parsed from the token as username/group1,group2
+      --insecure-bind-address ip                                The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all interfaces). Defaults to localhost. (default 127.0.0.1)
       --insecure-port int                                       The port on which to serve unsecured, unauthenticated access. Default 8080. It is assumed that firewall rules are set up such that this port is not reachable from outside of the cluster and that port 443 on the cluster's public address is proxied to this port. This is performed by nginx in the default setup. (default 8080)
       --kubernetes-service-node-port int                        If non-zero, the Kubernetes master service (which apiserver creates/maintains) will be of type NodePort, using this as the value of the port. If zero, the Kubernetes master service will be of type ClusterIP.
       --long-running-request-regexp string                      A regular expression matching long running requests which should be excluded from maximum inflight request handling. (default "(/|^)((watch|proxy)(/|$)|(logs?|portforward|exec|attach)/?$)")
-      --master-service-namespace string                         The namespace from which the kubernetes master services should be injected into pods. (default "default")
+      --master-service-namespace string                         DEPRECATED: the namespace from which the kubernetes master services should be injected into pods. (default "default")
       --max-requests-inflight int                               The maximum number of requests in flight at a given time. When the server exceeds this, it rejects requests. Zero for no limit. (default 400)
       --min-request-timeout int                                 An optional field indicating the minimum number of seconds a handler must keep a request open before timing it out. Currently only honored by the watch request handler, which picks a randomized value above this number as the connection timeout, to spread out load. (default 1800)
       --oidc-ca-file string                                     If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file, otherwise the host's root CA set will be used.
       --oidc-client-id string                                   The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set.
-      --oidc-groups-claim string                                If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be an array of strings. This flag is experimental, please see the authentication documentation for further details.
+      --oidc-groups-claim string                                If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be a string or array of strings. This flag is experimental, please see the authentication documentation for further details.
       --oidc-issuer-url string                                  The URL of the OpenID issuer, only HTTPS scheme will be accepted. If set, it will be used to verify the OIDC JSON Web Token (JWT).
       --oidc-username-claim string                              The OpenID claim to use as the user name. Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. This flag is experimental, please see the authentication documentation for further details. (default "sub")
       --profiling                                               Enable profiling via web interface host:port/debug/pprof/ (default true)
-      --runtime-config value                                    A set of key=value pairs that describe runtime configuration that may be passed to apiserver. apis/<groupVersion> key can be used to turn on/off specific api versions. apis/<groupVersion>/<resource> can be used to turn on/off specific resources. api/all and api/legacy are special keys to control all and legacy api versions respectively.
+      --requestheader-allowed-names stringSlice                 List of client certificate common names to allow to provide usernames in headers specified by --requestheader-username-headers. If empty, any client certificate validated by the authorities in --requestheader-client-ca-file is allowed.
+      --requestheader-client-ca-file string                     Root certificate bundle to use to verify client certificates on incoming requests before trusting usernames in headers specified by --requestheader-username-headers
+      --requestheader-username-headers stringSlice              List of request headers to inspect for usernames. X-Remote-User is common.
+      --runtime-config mapStringString                          A set of key=value pairs that describe runtime configuration that may be passed to apiserver. apis/<groupVersion> key can be used to turn on/off specific api versions. apis/<groupVersion>/<resource> can be used to turn on/off specific resources. api/all and api/legacy are special keys to control all and legacy api versions respectively.
       --secure-port int                                         The port on which to serve HTTPS with authentication and authorization. If 0, don't serve HTTPS at all. (default 6443)
-      --service-cluster-ip-range value                          A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes for pods.
+      --service-cluster-ip-range ipNet                          A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes for pods.
-      --service-node-port-range value                           A port range to reserve for services with NodePort visibility. Example: '30000-32767'. Inclusive at both ends of the range. (default 30000-32767)
+      --service-node-port-range portRange                       A port range to reserve for services with NodePort visibility. Example: '30000-32767'. Inclusive at both ends of the range. (default 30000-32767)
       --storage-backend string                                  The storage backend for persistence. Options: 'etcd2' (default), 'etcd3'.
       --storage-media-type string                               The media type to use to store objects in storage. Defaults to application/json. Some resources may only support a specific media type and will ignore this setting. (default "application/json")
-      --storage-versions string                                 The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1alpha1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,federation/v1beta1,policy/v1alpha1,rbac.authorization.k8s.io/v1alpha1,v1")
+      --storage-versions string                                 The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1beta1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates.k8s.io/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,federation/v1beta1,policy/v1beta1,rbac.authorization.k8s.io/v1alpha1,storage.k8s.io/v1beta1,v1")
       --target-ram-mb int                                       Memory limit for apiserver in MB (used to configure sizes of caches, etc.)
-      --tls-cert-file string                                    File containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.
+      --tls-ca-file string                                      If set, this certificate authority will used for secure access from Admission Controllers. This must be a valid PEM-encoded CA bundle.
-      --tls-private-key-file string                             File containing x509 private key matching --tls-cert-file.
+      --tls-cert-file string                                    File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.
+      --tls-private-key-file string                             File containing the default x509 private key matching --tls-cert-file.
+      --tls-sni-cert-key namedCertKey                           A pair of x509 certificate and private key file paths, optionally suffixed with a list of domain patterns which are fully qualified domain names, possibly with prefixed wildcard segments. If no domain patterns are provided, the names of the certificate are extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns trump over extracted names. For multiple key/certificate pairs, use the --tls-sni-cert-key multiple times. Examples: "example.key,example.crt" or "*.foo.com,foo.com:foo.key,foo.crt". (default [])
       --token-auth-file string                                  If set, the file that will be used to secure the secure port of the API server via token authentication.
       --watch-cache                                             Enable watch caching in the apiserver (default true)
-      --watch-cache-sizes value                                 List of watch cache sizes for every resource (pods, nodes, etc.), comma separated. The individual override format: resource#size, where size is a number. It takes effect when watch-cache is enabled. (default [])
+      --watch-cache-sizes stringSlice                           List of watch cache sizes for every resource (pods, nodes, etc.), comma separated. The individual override format: resource#size, where size is a number. It takes effect when watch-cache is enabled.
 ```
 
-###### Auto generated by spf13/cobra on 2-Sep-2016
+###### Auto generated by spf13/cobra on 13-Dec-2016
-
-
-
-
 
 
 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->

docs/admin/federation-controller-manager.md

@@ -1,4 +1,6 @@
 ---
+title: federation-controller-mananger
+notitle: true
 ---
 
 ## federation-controller-manager
@@ -23,14 +25,14 @@ federation-controller-manager
 ### Options
 
 ```
-      --address value                          The IP address to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
+      --address ip                             The IP address to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
       --cluster-monitor-period duration        The period for syncing ClusterStatus in ClusterController. (default 40s)
       --concurrent-replicaset-syncs int        The number of ReplicaSets syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load (default 10)
       --concurrent-service-syncs int           The number of service syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load (default 10)
-      --dns-provider string                    DNS provider. Valid values are: ["aws-route53" "google-clouddns"]
+      --dns-provider string                    DNS provider. Valid values are: ["google-clouddns" "aws-route53"]
       --dns-provider-config string             Path to config file for configuring DNS provider.
       --federated-api-burst int                Burst to use while talking with federation apiserver (default 30)
-      --federated-api-qps value                QPS to use while talking with federation apiserver (default 20)
+      --federated-api-qps float32              QPS to use while talking with federation apiserver (default 20)
       --federation-name string                 Federation name.
       --kube-api-content-type string           ContentType of requests sent to apiserver. Passing application/vnd.kubernetes.protobuf is an experimental feature now.
       --kubeconfig string                      Path to kubeconfig file with authorization and master location information.
@@ -41,14 +43,12 @@ federation-controller-manager
       --master string                          The address of the federation API server (overrides any value in kubeconfig)
       --port int                               The port that the controller-manager's http service runs on (default 10253)
       --profiling                              Enable profiling via web interface host:port/debug/pprof/ (default true)
+      --service-dns-suffix string              DNS Suffix to use when publishing federated service names.  Defaults to zone-name
+      --zone-id string                         Zone ID, needed if the zone name is not unique.
       --zone-name string                       Zone name, like example.com.
 ```
 
-###### Auto generated by spf13/cobra on 2-Sep-2016
+###### Auto generated by spf13/cobra on 13-Dec-2016
-
-
-
-
 
 
 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->

docs/admin/federation/index.md

@@ -3,8 +3,9 @@ assignees:
 - madhusudancs
 - mml
 - nikhiljindal
-
+title: Using `federation-up` and `deploy.sh`
 ---
+
 This guide explains how to set up cluster federation that lets us control multiple Kubernetes clusters.
 
 
@@ -14,11 +15,11 @@ This guide explains how to set up cluster federation that lets us control multip
 ## Prerequisites
 
 This guide assumes that you have a running Kubernetes cluster.
-If not, then head over to the [getting started guides](/docs/getting-started-guides/) to bring up a cluster.
+If you need to start a new cluster, see the [getting started guides](/docs/getting-started-guides/) for instructions on bringing a cluster up.
 
-This guide also assumes that you have a Kubernetes release
+To use the commands in this guide, you must download a Kubernetes release from the 
-[downloaded from here](/docs/getting-started-guides/binary_release/),
+[getting started binary releases](/docs/getting-started-guides/binary_release/) and 
-extracted into a directory and all the commands in this guide are run from
+extract into a directory; all the commands in this guide are run from
 that directory.
 
 ```shell
@@ -26,8 +27,8 @@ $ curl -L https://github.com/kubernetes/kubernetes/releases/download/v1.4.0/kube
 $ cd kubernetes
 ```
 
-This guide also assumes that you have an installation of Docker running
+You must also have a Docker installation running
-locally, i.e. on the machine where you run the commands described in this
+locally--meaning on the machine where you run the commands described in this
 guide.
 
 ## Setting up a federation control plane
@@ -109,7 +110,7 @@ $ KUBE_REGISTRY="gcr.io/myrepository" federation/develop/develop.sh build_image
 $ KUBE_REGISTRY="gcr.io/myrepository" federation/develop/develop.sh push
 ```
 
-Note: This is going to overwite the values you might have set for
+Note: This is going to overwrite the values you might have set for
 `apiserverRegistry`, `apiserverVersion`, `controllerManagerRegistry` and
 `controllerManagerVersion` in your `${FEDERATION_OUTPUT_ROOT}/values.yaml`
 file. Hence, it is not recommend to customize these values in
@@ -212,47 +213,81 @@ cluster1   Ready               3m
 
 ## Updating KubeDNS
 
-Once the cluster is registered with the federation, you are all set to use it.
+Once you've registered your cluster with the federation, you'll need to update KubeDNS so that your cluster can route federation service requests. The update method varies depending on your Kubernetes version; on Kubernetes 1.5 or later, you must pass the
-But for the cluster to be able to route federation service requests, you need to restart
+`--federations` flag to kube-dns via the kube-dns config map. In version 1.4 or earlier, you must set the `--federations` flag directly on kube-dns-rc on other clusters.
-KubeDNS and pass it a `--federations` flag which tells it about valid federation DNS hostnames.
+
-Format of the flag is like this:
+### Kubernetes 1.5+: Passing federations flag via config map to kube-dns
+
+For Kubernetes clusters of version 1.5+, you can pass the
+`--federations` flag to kube-dns via the kube-dns config map.
+The flag uses the following format:
 
 ```
 --federations=${FEDERATION_NAME}=${DNS_DOMAIN_NAME}
 ```
 
-To update KubeDNS with federations flag, you can edit the existing kubedns replication controller to
+To pass this flag to KubeDNS, create a config-map with name `kube-dns` in
-include that flag in pod template spec and then delete the existing pod. Replication controller will
+namespace `kube-system`. The configmap should look like the following:
-recreate the pod with updated template.
 
-To find the name of existing kubedns replication controller, run
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kube-dns
+  namespace: kube-system
+data:
+  federations: <federation-name>=<dns-domain-name>
+```
+
+where `<federation-name>` should be replaced by the name you want to give to your
+federation, and
+`federation-domain-name` should be replaced by the domain name you want to use
+in your federation DNS.
+
+You can find more details about config maps in general at
+http://kubernetes.io/docs/user-guide/configmap/.
+
+### Kubernetes 1.4 and earlier: Setting federations flag on kube-dns-rc
+
+If your cluster is running Kubernetes version 1.4 or earlier, you must to restart
+KubeDNS and pass it a `--federations` flag, which tells it about valid federation DNS hostnames.
+The flag uses the following format:
+
+```
+--federations=${FEDERATION_NAME}=${DNS_DOMAIN_NAME}
+```
+
+To update KubeDNS with the `--federations` flag, you can edit the existing kubedns replication controller to
+include that flag in pod template spec, and then delete the existing pod. The replication controller then
+recreates the pod with updated template.
+
+To find the name of existing kubedns replication controller, run the following command:
 
 ```shell
 $ kubectl get rc --namespace=kube-system
 ```
 
-This will list all the replication controllers. Name of the kube-dns replication
+You should see a list of all the replication controllers on the cluster. The kube-dns replication
-controller will look like `kube-dns-v18`. You can then edit it by running:
+controller should have a name similar to `kube-dns-v18`. To edit the replication controller, specify it by name as follows:
 
 ```shell
 $ kubectl edit rc <rc-name> --namespace=kube-system
 ```
-Add the `--federations` flag as args to kube-dns container in the YAML file that
+In the resulting YAML file for the kube-dns replication controller, add the `--federations` flag as an argument to kube-dns container.
-pops up after running the above command.
 
-To delete the existing kube dns pod, you can first find it by running:
+Then, you must delete the existing kube dns pod. You can find the pod by running:
 
 ```shell
 $ kubectl get pods --namespace=kube-system
 ```
 
-And then delete it by running:
+And then delete the appropriate pod by running:
 
 ```shell
 $ kubectl delete pods <pod-name> --namespace=kube-system
 ```
 
-You are now all set to start using federation.
+Once you've completed the kube-dns configuration, your federation is ready for use.
 
 ## Turn down
 
@@ -317,7 +352,7 @@ $ KUBERNETES_PROVIDER=gce FEDERATION_DNS_PROVIDER=google-clouddns FEDERATION_NAM
 set appropriately if it is missing and `KUBERNETES_PROVIDER` is one of `gce`, `gke` and `aws`.
 This is used to resolve DNS requests for federation services. The service
 controller keeps DNS records with the provider updated as services/pods are
-updated in underlying kubernetes clusters.
+updated in underlying Kubernetes clusters.
 
 `FEDERATION_NAME` is a name you can choose for your federation. This is the name that will appear in DNS routes.
 

docs/admin/federation/kubefed.md

@@ -0,0 +1,194 @@
+---
+assignees:
+- madhusudancs
+
+---
+
+* TOC
+{:toc}
+
+Kubernetes version 1.5 includes a new command line tool called
+`kubefed` to help you administrate your federated clusters.
+`kubefed` helps you to deploy a new Kubernetes cluster federation
+control plane, and to add clusters to or remove clusters from an
+existing federation control plane.
+
+This guide explains how to administer a Kubernetes Cluster Federation
+using `kubefed`.
+
+> Note: `kubefed` is an alpha feature in Kubernetes 1.5.
+
+## Prerequisites
+
+This guide assumes that you have a running Kubernetes cluster. Please
+see one of the [getting started](/docs/getting-started-guides/) guides
+for installation instructions for your platform.
+
+
+## Getting `kubefed`
+
+Download the client tarball corresponding to Kubernetes version 1.5
+or later
+[from the release page](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG.md),
+extract the binaries in the tarball to one of the directories
+in your `$PATH` and set the executable permission on those binaries.
+
+```shell
+curl -O https://storage.googleapis.com/kubernetes-release/release/v1.5.0/kubernetes-client-linux-amd64.tar.gz
+tar -xzvf kubernetes-client-linux-amd64.tar.gz
+sudo cp kubernetes/client/bin/kubefed /usr/local/bin
+sudo chmod +x /usr/local/bin/kubefed
+sudo cp kubernetes/client/bin/kubectl /usr/local/bin
+sudo chmod +x /usr/local/bin/kubectl
+```
+
+
+## Choosing a host cluster.
+
+You'll need to choose one of your Kubernetes clusters to be the
+*host cluster*. The host cluster hosts the components that make up
+your federation control plane. Ensure that you have a `kubeconfig`
+entry in your local `kubeconfig` that corresponds to the host cluster.
+You can verify that you have the required `kubeconfig` entry by
+running:
+
+```shell
+kubectl config get-contexts
+```
+
+The output should contain an entry corresponding to your host cluster,
+similar to the following:
+
+```
+CURRENT   NAME                                          CLUSTER                                       AUTHINFO                                      NAMESPACE
+          gke_myproject_asia-east1-b_gce-asia-east1     gke_myproject_asia-east1-b_gce-asia-east1     gke_myproject_asia-east1-b_gce-asia-east1
+```
+
+
+You'll need to provide the `kubeconfig` context (called name in the
+entry above) for your host cluster when you deploy your federation
+control plane.
+
+
+## Deploying a federation control plane.
+
+"To deploy a federation control plane on your host cluster, run
+`kubefed init` command. When you use `kubefed init`, you must provide
+the following:
+
+* Federation name
+* `--host-cluster-context`, the `kubeconfig` context for the host cluster
+* `--dns-zone-name`, a domain name suffix for your federated services
+
+The following example command deploys a federation control plane with
+the name `fellowship`, a host cluster context `rivendell`, and the
+domain suffix `example.com`:
+
+```shell
+kubefed init fellowship --host-cluster-context=rivendell  --dns-zone-name="example.com"
+```
+
+The domain suffix you specify in `--dns-zone-name` must be an existing
+domain that you control, and that is programmable by your DNS provider.
+
+`kubefed init` sets up the federation control plane in the host
+cluster and also adds an entry for the federation API server in your
+local kubeconfig. Note that in the alpha release in Kubernetes 1.5,
+`kubefed init` does not automatically set the current context to the
+newly deployed federation. You can set the current context manually by
+running:
+
+```shell
+kubectl config use-context fellowship
+```
+
+where `fellowship` is the name of your federation.
+
+
+## Adding a cluster to a federation
+
+Once you've deployed a federation control plane, you'll need to make
+that control plane aware of the clusters it should manage. You can add
+a cluster to your federation by using the `kubefed join` command.
+
+To use `kubefed join`, you'll need to provide the name of the cluster
+you want to add to the federation, and the `--host-cluster-context`
+for the federation control plane's host cluster.
+
+The following example command adds the cluster `gondor` to the
+federation with host cluster `rivendell`:
+
+```
+kubefed join gondor --host-cluster-context=rivendell
+```
+
+> Note: Kubernetes requires that you manually join clusters to a
+federation because the federation control plane manages only those
+clusters that it is responsible for managing. Adding a cluster tells
+the federation control plane that it is responsible for managing that
+cluster.
+
+### Naming rules and customization
+
+The cluster name you supply to `kubefed join` must be a valid RFC 1035
+label.
+
+Furthermore, federation control plane requires credentials of the
+joined clusters to operate on them. These credentials are obtained
+from the local kubeconfig. `kubefed join` uses the cluster name
+specified as the argument to look for the cluster's context in the
+local kubeconfig. If it fails to find a matching context, it exits
+with an error.
+
+This might cause issues in cases where context names for each cluster
+in the federation don't follow RFC 1035 label naming rules. In such
+cases, you can specify a cluster name that conforms to the RFC 1035
+label naming rules and specify the cluster context using the
+`--cluster-context` flag. For example, if context of the cluster your
+are joining is `gondor_needs-no_king`, then you can
+join the cluster by running:
+
+```shell
+kubefed join gondor --host-cluster-context=rivendell --cluster-context=gondor_needs-no_king
+```
+
+#### Secret name
+
+Cluster credentials required by the federation control plane as
+described above are stored as a secret in the host cluster. The name
+of the secret is also derived from the cluster name.
+
+However, the name of a secret object in Kubernetes should conform
+to the subdomain name specification described in RFC 1123. If this
+isn't case, you can pass the secret name to `kubefed join` using the
+`--secret-name` flag. For example, if the cluster name is `noldor` and
+the secret name is `11kingdom`, you can join the cluster by
+running:
+
+```shell
+kubefed join noldor --host-cluster-context=rivendell --secret-name=11kingdom
+```
+
+## Removing a cluster from a federation
+
+To remove a cluster from a federation, run the `kubefed unjoin`
+command with the cluster name and the federation's
+`--host-cluster-context`:
+
+```
+kubefed unjoin gondor --host-cluster-context=rivendell
+```
+
+
+## Turning down the federation control plane:
+
+Proper cleanup of federation control plane is not fully implemented in
+this alpha release of `kubefed`. However, for the time being, deleting
+the federation system namespace should remove all the resources except
+the persistent storage volume dynamically provisioned for the
+federation control plane's etcd. You can delete the federation
+namespace by running the following command:
+
+```
+$ kubectl delete ns federation-system
+```

docs/admin/garbage-collection.md

@@ -1,7 +1,7 @@
 ---
 assignees:
 - mikedanese
-
+title: Configuring kubelet Garbage Collection
 ---
 
 * TOC
@@ -13,11 +13,11 @@ External garbage collection tools are not recommended as these tools can potenti
 
 ### Image Collection
 
-kubernetes manages lifecycle of all images through imageManager, with the cooperation
+Kubernetes manages lifecycle of all images through imageManager, with the cooperation
 of cadvisor.
 
 The policy for garbage collecting images takes two factors into consideration:
-`HighThresholdPercent` and `LowThresholdPercent`. Disk usage above the the high threshold
+`HighThresholdPercent` and `LowThresholdPercent`. Disk usage above the high threshold
 will trigger garbage collection. The garbage collection will delete least recently used images until the low
 threshold has been met.
 

docs/admin/ha-master-gce.md

@@ -0,0 +1,160 @@
+---
+assignees:
+- jszczepkowski
+
+---
+
+* TOC
+{:toc}
+
+## Introduction
+
+Kubernetes version 1.5 adds alpha support for replicating Kubernetes masters in `kube-up` or `kube-down` scripts for Google Compute Engine.
+This document describes how to use kube-up/down scripts to manage highly available (HA) masters and how HA masters are implemented for use with GCE.
+
+## Starting an HA-compatible cluster
+
+To create a new HA-compatible cluster, you must set the following flags in your `kube-up` script:
+
+* `MULTIZONE=true` - to prevent removal of master replicas kubelets from zones different than server's default zone.
+Required if you want to run master replicas in different zones, which is recommended.
+
+* `ENABLE_ETCD_QUORUM_READS=true` - to ensure that reads from all API servers will return most up-to-date data.
+If true, reads will be directed to leader etcd replica.
+Setting this value to true is optional: reads will be more reliable but will also be slower.
+
+Optionally, you can specify a GCE zone where the first master replica is to be created.
+Set the following flag:
+
+* `KUBE_GCE_ZONE=zone` - zone where the first master replica will run.
+
+The following sample command sets up a HA-compatible cluster in the GCE zone europe-west1-b:
+
+```shell
+$ MULTIZONE=true KUBE_GCE_ZONE=europe-west1-b  ENABLE_ETCD_QUORUM_READS=true ./cluster/kube-up.sh
+```
+
+Note that the commands above create a cluster with one master;
+however, you can add new master replicas to the cluster with subsequent commands.
+
+## Adding a new master replica
+
+After you have created an HA-compatible cluster, you can add master replicas to it.
+You add master replicas by using a `kube-up` script with the following flags:
+
+* `KUBE_REPLICATE_EXISTING_MASTER=true` - to create a replica of an existing
+master.
+
+* `KUBE_GCE_ZONE=zone` - zone where the master replica will run.
+Must be in the same region as other replicas' zones.
+
+You don't need to set the `MULTIZONE` or `ENABLE_ETCD_QUORUM_READS` flags,
+as those are inherited from when you started your HA-compatible cluster.
+
+The following sample command replicates the master on an existing HA-compatible cluster:
+
+```shell
+$ KUBE_GCE_ZONE=europe-west1-c KUBE_REPLICATE_EXISTING_MASTER=true ./cluster/kube-up.sh
+```
+
+## Removing a master replica
+
+You can remove a master replica from an HA cluster by using a `kube-down` script with the following flags:
+
+* `KUBE_DELETE_NODES=false` - to restrain deletion of kubelets.
+
+* `KUBE_GCE_ZONE=zone` - the zone from where master replica will be removed.
+ 
+* `KUBE_REPLICA_NAME=replica_name` - (optional) the name of master replica to remove.
+If empty: any replica from the given zone will be removed.
+
+The following sample command removes a master replica from an existing HA cluster:
+
+```shell
+$ KUBE_DELETE_NODES=false KUBE_GCE_ZONE=europe-west1-c ./cluster/kube-down.sh
+```
+
+## Handling master replica failures
+
+If one of the master replicas in your HA cluster fails,
+the best practice is to remove the replica from your cluster and add a new replica in the same zone.
+The following sample commands demonstrate this process:
+
+1. Remove the broken replica:
+
+```shell
+$ KUBE_DELETE_NODES=false KUBE_GCE_ZONE=replica_zone KUBE_REPLICA_NAME=replica_name ./cluster/kube-down.sh
+```
+
+2. Add a new replica in place of the old one:
+
+```shell
+$ KUBE_GCE_ZONE=replica-zone KUBE_REPLICATE_EXISTING_MASTER=true ./cluster/kube-up.sh
+```
+
+## Best practices for replicating masters for HA clusters
+
+* Try to place masters replicas in different zones. During a zone failure, all master placed inside the zone will fail.
+To survive zone failure, also place nodes in multiple zones
+(see [multiple-zones](http://kubernetes.io/docs/admin/multiple-zones/) for details).
+
+* Do not use a cluster with two master replicas. Consensus on a two replica cluster requires both replicas running when changing persistent state.
+As a result, both replicas are needed and a failure of any replica turns cluster into majority failure state.
+A two-replica cluster is thus inferior, in terms of HA, to a single replica cluster.
+
+* When you add a master replica, cluster state (etcd) is copied to a new instance.
+If the cluster is large, it may take a long time to duplicate its state.
+This operation may be speed up by migrating etcd data directory, as described [here](https://coreos.com/etcd/docs/latest/admin_guide.html#member-migration) here
+(we are considering adding support for etcd data dir migration in future).
+
+## Implementation notes
+
+![](ha-master-gce.png)
+
+### Overview
+
+Each of master replicas will run the following components in the following mode:
+
+* etcd instance: all instances will be clustered together using consensus;
+
+* API server: each server will talk to local etcd - all API servers in the cluster will be available;
+
+* controllers, scheduler, and cluster auto-scaler: will use lease mechanism - only one instance of each of them will be active in the cluster;
+
+* add-on manager: each manager will work independently trying to keep add-ons in sync.
+
+In addition, there will be a load balancer in front of API servers that will route external and internal traffic to them.
+
+### Load balancing
+
+When starting the second master replica, a load balancer containing the two replicas will be created
+and the IP address of the first replica will be promoted to IP address of load balancer.
+Similarly, after removal of the penultimate master replica, the load balancer will be removed and its IP address will be assigned to the last remaining replica.
+Please note that creation and removal of load balancer are complex operations and it may take some time (~20 minutes) for them to propagate.
+
+### Master service & kubelets
+
+Instead of trying to keep an up-to-date list of Kubernetes apiserver in the Kubernetes service,
+the system directs all traffic to the external IP:
+
+* in one master cluster the IP points to the single master,
+
+* in multi-master cluster the IP points to the load balancer in-front of the masters.
+
+Similarly, the external IP will be used by kubelets to communicate with master.
+
+### Master certificates
+
+Kubernetes generates Master TLS certificates for the external public IP and local IP for each replica.
+There are no certificates for the ephemeral public IP for replicas;
+to access a replica via its ephemeral public IP, you must skip TLS verification.
+
+### Clustering etcd
+
+To allow etcd clustering, ports needed to communicate between etcd instances will be opened (for inside cluster communication).
+To make such deployment secure, communication between etcd instances is authorized using SSL.
+
+## Additional reading
+
+[Automated HA master deployment - design doc](https://github.com/kubernetes/kubernetes/blob/master/docs/design/ha_master.md)
+

docs/admin/high-availability/index.md

@@ -1,5 +1,5 @@
 ---
-
+title: Building High-Availability Clusters
 ---
 
 ## Introduction
@@ -100,16 +100,15 @@ for `${NODE_IP}` on each machine.
 
 #### Validating your cluster
 
-Once you copy this into all three nodes, you should have a clustered etcd set up.  You can validate with
+Once you copy this into all three nodes, you should have a clustered etcd set up.  You can validate on master with
-
 ```shell
-etcdctl member list
+kubectl exec < pod_name > etcdctl member list
 ```
 
 and
 
 ```shell
-etcdctl cluster-health
+kubectl exec < pod_name > etcdctl cluster-health
 ```
 
 You can also validate that this is working with `etcdctl set foo bar` on one node, and `etcdctl get foo`

docs/admin/index.md

@@ -2,7 +2,7 @@
 assignees:
 - davidopp
 - lavalamp
-
+title: Admin Guide
 ---
 
 The cluster admin guide is for anyone creating or administering a Kubernetes cluster.
@@ -13,7 +13,7 @@ It assumes some familiarity with concepts in the [User Guide](/docs/user-guide/)
 
 ## Planning a cluster
 
-There are many different examples of how to setup a kubernetes cluster.  Many of them are listed in this
+There are many different examples of how to setup a Kubernetes cluster.  Many of them are listed in this
 [matrix](/docs/getting-started-guides/).  We call each of the combinations in this matrix a *distro*.
 
 Before choosing a particular guide, here are some things to consider:
@@ -25,12 +25,12 @@ Before choosing a particular guide, here are some things to consider:
  - Will your cluster be on-premises, or in the cloud (IaaS)?  Kubernetes does not directly support hybrid clusters.  We
    recommend setting up multiple clusters rather than spanning distant locations.
  - Will you be running Kubernetes on "bare metal" or virtual machines?  Kubernetes supports both, via different distros.
- - Do you just want to run a cluster, or do you expect to do active development of kubernetes project code?  If the
+ - Do you just want to run a cluster, or do you expect to do active development of Kubernetes project code?  If the
    latter, it is better to pick a distro actively used by other developers.  Some distros only use binary releases, but
    offer is a greater variety of choices.
  - Not all distros are maintained as actively.  Prefer ones which are listed as tested on a more recent version of
    Kubernetes.
- - If you are configuring kubernetes on-premises, you will need to consider what [networking
+ - If you are configuring Kubernetes on-premises, you will need to consider what [networking
    model](/docs/admin/networking) fits best.
  - If you are designing for very high-availability, you may want [clusters in multiple zones](/docs/admin/multi-cluster).
  - You may want to familiarize yourself with the various
@@ -84,3 +84,8 @@ project](/docs/admin/salt).
 * **Sysctls** [sysctls](/docs/admin/sysctls.md)
 
 * **Audit** [audit](/docs/admin/audit)
+
+* **Securing the kubelet**
+  * [Master-Node communication](/docs/admin/master-node-communication/)
+  * [TLS bootstrapping](/docs/admin/kubelet-tls-bootstrapping/)
+  * [Kubelet authentication/authorization](/docs/admin/kubelet-authentication-authorization/)

docs/admin/kube-apiserver.md

@@ -1,4 +1,6 @@
 ---
+title: kube-apiserver
+notitle: true
 ---
 
 ## kube-apiserver
@@ -20,11 +22,12 @@ kube-apiserver
 ### Options
 
 ```
-      --admission-control string                                Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, DefaultStorageClass, DenyEscalatingExec, DenyExecOnPrivileged, ImagePolicyWebhook, InitialResources, LimitPodHardAntiAffinityTopology, LimitRanger, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, PersistentVolumeLabel, PodSecurityPolicy, ResourceQuota, SecurityContextDeny, ServiceAccount. (default "AlwaysAdmit")
+      --admission-control string                                Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, DefaultStorageClass, DenyEscalatingExec, DenyExecOnPrivileged, ImagePolicyWebhook, InitialResources, LimitPodHardAntiAffinityTopology, LimitRanger, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, OwnerReferencesPermissionEnforcement, PersistentVolumeLabel, PodNodeSelector, PodSecurityPolicy, ResourceQuota, SecurityContextDeny, ServiceAccount. (default "AlwaysAdmit")
       --admission-control-config-file string                    File with admission control configuration.
-      --advertise-address value                                 The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.
+      --advertise-address ip                                    The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.
       --allow-privileged                                        If true, allow privileged containers.
-      --apiserver-count int                                     The number of apiservers running in the cluster. (default 1)
+      --anonymous-auth                                          Enables anonymous requests to the secure port of the API server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated. (default true)
+      --apiserver-count int                                     The number of apiservers running in the cluster. Must be a positive number. (default 1)
       --audit-log-maxage int                                    The maximum number of days to retain old audit log files based on the timestamp encoded in their filename.
       --audit-log-maxbackup int                                 The maximum number of old audit log files to retain.
       --audit-log-maxsize int                                   The maximum size in megabytes of the audit log file before it gets rotated. Defaults to 100MB.
@@ -38,14 +41,15 @@ kube-apiserver
       --authorization-webhook-cache-unauthorized-ttl duration   The duration to cache 'unauthorized' responses from the webhook authorizer. Default is 30s. (default 30s)
       --authorization-webhook-config-file string                File with webhook configuration in kubeconfig format, used with --authorization-mode=Webhook. The API server will query the remote service to determine access on the API server's secure port.
       --basic-auth-file string                                  If set, the file that will be used to admit requests to the secure port of the API server via http basic authentication.
-      --bind-address value                                      The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank, all interfaces will be used (0.0.0.0). (default 0.0.0.0)
+      --bind-address ip                                         The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank, all interfaces will be used (0.0.0.0). (default 0.0.0.0)
       --cert-dir string                                         The directory where the TLS certs are located (by default /var/run/kubernetes). If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored. (default "/var/run/kubernetes")
       --client-ca-file string                                   If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.
       --cloud-config string                                     The path to the cloud provider configuration file. Empty string for no configuration file.
       --cloud-provider string                                   The provider for cloud services. Empty string for no provider.
-      --cors-allowed-origins value                              List of allowed origins for CORS, comma separated.  An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled. (default [])
+      --contention-profiling                                    Enable contention profiling. Requires --profiling to be set to work.
+      --cors-allowed-origins stringSlice                        List of allowed origins for CORS, comma separated.  An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled.
       --delete-collection-workers int                           Number of workers spawned for DeleteCollection call. These are used to speed up namespace cleanup. (default 1)
-      --deserialization-cache-size int                          Number of deserialized json objects to cache in memory. (default 50000)
+      --deserialization-cache-size int                          Number of deserialized json objects to cache in memory.
       --enable-garbage-collector                                Enables the generic garbage collector. MUST be synced with the corresponding flag of the kube-controller-manager. (default true)
       --enable-swagger-ui                                       Enables swagger ui on the apiserver at /swagger-ui
       --etcd-cafile string                                      SSL Certificate Authority file used to secure etcd communication.
@@ -53,62 +57,68 @@ kube-apiserver
       --etcd-keyfile string                                     SSL key file used to secure etcd communication.
       --etcd-prefix string                                      The prefix for all resource paths in etcd. (default "/registry")
       --etcd-quorum-read                                        If true, enable quorum read.
-      --etcd-servers value                                      List of etcd servers to connect with (http://ip:port), comma separated. (default [])
+      --etcd-servers stringSlice                                List of etcd servers to connect with (scheme://ip:port), comma separated.
-      --etcd-servers-overrides value                            Per-resource etcd servers overrides, comma separated. The individual override format: group/resource#servers, where servers are http://ip:port, semicolon separated. (default [])
+      --etcd-servers-overrides stringSlice                      Per-resource etcd servers overrides, comma separated. The individual override format: group/resource#servers, where servers are http://ip:port, semicolon separated.
       --event-ttl duration                                      Amount of time to retain events. Default is 1h. (default 1h0m0s)
+      --experimental-keystone-ca-file string                    If set, the Keystone server's certificate will be verified by one of the authorities in the experimental-keystone-ca-file, otherwise the host's root CA set will be used.
       --experimental-keystone-url string                        If passed, activates the keystone authentication plugin.
       --external-hostname string                                The hostname to use when generating externalized URLs for this master (e.g. Swagger API Docs).
-      --feature-gates value                                     A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --feature-gates mapStringBool                             A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
 AllAlpha=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
 AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
+StreamingProxyRedirects=true|false (ALPHA - default=false)
       --google-json-key string                                  The Google Cloud Platform Service Account JSON Key to use for authentication.
-      --insecure-bind-address value                             The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all interfaces). Defaults to localhost. (default 127.0.0.1)
+      --insecure-allow-any-token username/group1,group2         If set, your server will be INSECURE.  Any token will be allowed and user information will be parsed from the token as username/group1,group2
+      --insecure-bind-address ip                                The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all interfaces). Defaults to localhost. (default 127.0.0.1)
       --insecure-port int                                       The port on which to serve unsecured, unauthenticated access. Default 8080. It is assumed that firewall rules are set up such that this port is not reachable from outside of the cluster and that port 443 on the cluster's public address is proxied to this port. This is performed by nginx in the default setup. (default 8080)
       --kubelet-certificate-authority string                    Path to a cert file for the certificate authority.
       --kubelet-client-certificate string                       Path to a client cert file for TLS.
       --kubelet-client-key string                               Path to a client key file for TLS.
       --kubelet-https                                           Use https for kubelet connections. (default true)
+      --kubelet-preferred-address-types stringSlice             List of the preferred NodeAddressTypes to use for kubelet connections. (default [Hostname,InternalIP,ExternalIP,LegacyHostIP])
       --kubelet-timeout duration                                Timeout for kubelet operations. (default 5s)
       --kubernetes-service-node-port int                        If non-zero, the Kubernetes master service (which apiserver creates/maintains) will be of type NodePort, using this as the value of the port. If zero, the Kubernetes master service will be of type ClusterIP.
       --long-running-request-regexp string                      A regular expression matching long running requests which should be excluded from maximum inflight request handling. (default "(/|^)((watch|proxy)(/|$)|(logs?|portforward|exec|attach)/?$)")
-      --master-service-namespace string                         The namespace from which the kubernetes master services should be injected into pods. (default "default")
+      --master-service-namespace string                         DEPRECATED: the namespace from which the kubernetes master services should be injected into pods. (default "default")
       --max-connection-bytes-per-sec int                        If non-zero, throttle each user connection to this number of bytes/sec. Currently only applies to long-running requests.
       --max-requests-inflight int                               The maximum number of requests in flight at a given time. When the server exceeds this, it rejects requests. Zero for no limit. (default 400)
       --min-request-timeout int                                 An optional field indicating the minimum number of seconds a handler must keep a request open before timing it out. Currently only honored by the watch request handler, which picks a randomized value above this number as the connection timeout, to spread out load. (default 1800)
       --oidc-ca-file string                                     If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file, otherwise the host's root CA set will be used.
       --oidc-client-id string                                   The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set.
-      --oidc-groups-claim string                                If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be an array of strings. This flag is experimental, please see the authentication documentation for further details.
+      --oidc-groups-claim string                                If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be a string or array of strings. This flag is experimental, please see the authentication documentation for further details.
       --oidc-issuer-url string                                  The URL of the OpenID issuer, only HTTPS scheme will be accepted. If set, it will be used to verify the OIDC JSON Web Token (JWT).
       --oidc-username-claim string                              The OpenID claim to use as the user name. Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. This flag is experimental, please see the authentication documentation for further details. (default "sub")
       --profiling                                               Enable profiling via web interface host:port/debug/pprof/ (default true)
       --repair-malformed-updates                                If true, server will do its best to fix the update request to pass the validation, e.g., setting empty UID in update request to its existing value. This flag can be turned off after we fix all the clients that send malformed updates. (default true)
-      --runtime-config value                                    A set of key=value pairs that describe runtime configuration that may be passed to apiserver. apis/<groupVersion> key can be used to turn on/off specific api versions. apis/<groupVersion>/<resource> can be used to turn on/off specific resources. api/all and api/legacy are special keys to control all and legacy api versions respectively.
+      --requestheader-allowed-names stringSlice                 List of client certificate common names to allow to provide usernames in headers specified by --requestheader-username-headers. If empty, any client certificate validated by the authorities in --requestheader-client-ca-file is allowed.
+      --requestheader-client-ca-file string                     Root certificate bundle to use to verify client certificates on incoming requests before trusting usernames in headers specified by --requestheader-username-headers
+      --requestheader-username-headers stringSlice              List of request headers to inspect for usernames. X-Remote-User is common.
+      --runtime-config mapStringString                          A set of key=value pairs that describe runtime configuration that may be passed to apiserver. apis/<groupVersion> key can be used to turn on/off specific api versions. apis/<groupVersion>/<resource> can be used to turn on/off specific resources. api/all and api/legacy are special keys to control all and legacy api versions respectively.
       --secure-port int                                         The port on which to serve HTTPS with authentication and authorization. If 0, don't serve HTTPS at all. (default 6443)
-      --service-account-key-file string                         File containing PEM-encoded x509 RSA private or public key, used to verify ServiceAccount tokens. If unspecified, --tls-private-key-file is used.
+      --service-account-key-file stringArray                    File containing PEM-encoded x509 RSA or ECDSA private or public keys, used to verify ServiceAccount tokens. If unspecified, --tls-private-key-file is used. The specified file can contain multiple keys, and the flag can be specified multiple times with different files.
       --service-account-lookup                                  If true, validate ServiceAccount tokens exist in etcd as part of authentication.
-      --service-cluster-ip-range value                          A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes for pods.
+      --service-cluster-ip-range ipNet                          A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes for pods.
-      --service-node-port-range value                           A port range to reserve for services with NodePort visibility. Example: '30000-32767'. Inclusive at both ends of the range. (default 30000-32767)
+      --service-node-port-range portRange                       A port range to reserve for services with NodePort visibility. Example: '30000-32767'. Inclusive at both ends of the range. (default 30000-32767)
       --ssh-keyfile string                                      If non-empty, use secure SSH proxy to the nodes, using this user keyfile
       --ssh-user string                                         If non-empty, use secure SSH proxy to the nodes, using this user name
       --storage-backend string                                  The storage backend for persistence. Options: 'etcd2' (default), 'etcd3'.
       --storage-media-type string                               The media type to use to store objects in storage. Defaults to application/json. Some resources may only support a specific media type and will ignore this setting. (default "application/json")
-      --storage-versions string                                 The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1alpha1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,imagepolicy.k8s.io/v1alpha1,policy/v1alpha1,rbac.authorization.k8s.io/v1alpha1,v1")
+      --storage-versions string                                 The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1beta1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates.k8s.io/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,imagepolicy.k8s.io/v1alpha1,policy/v1beta1,rbac.authorization.k8s.io/v1alpha1,storage.k8s.io/v1beta1,v1")
       --target-ram-mb int                                       Memory limit for apiserver in MB (used to configure sizes of caches, etc.)
-      --tls-cert-file string                                    File containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.
+      --tls-ca-file string                                      If set, this certificate authority will used for secure access from Admission Controllers. This must be a valid PEM-encoded CA bundle.
-      --tls-private-key-file string                             File containing x509 private key matching --tls-cert-file.
+      --tls-cert-file string                                    File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.
+      --tls-private-key-file string                             File containing the default x509 private key matching --tls-cert-file.
+      --tls-sni-cert-key namedCertKey                           A pair of x509 certificate and private key file paths, optionally suffixed with a list of domain patterns which are fully qualified domain names, possibly with prefixed wildcard segments. If no domain patterns are provided, the names of the certificate are extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns trump over extracted names. For multiple key/certificate pairs, use the --tls-sni-cert-key multiple times. Examples: "example.key,example.crt" or "*.foo.com,foo.com:foo.key,foo.crt". (default [])
       --token-auth-file string                                  If set, the file that will be used to secure the secure port of the API server via token authentication.
       --watch-cache                                             Enable watch caching in the apiserver (default true)
-      --watch-cache-sizes value                                 List of watch cache sizes for every resource (pods, nodes, etc.), comma separated. The individual override format: resource#size, where size is a number. It takes effect when watch-cache is enabled. (default [])
+      --watch-cache-sizes stringSlice                           List of watch cache sizes for every resource (pods, nodes, etc.), comma separated. The individual override format: resource#size, where size is a number. It takes effect when watch-cache is enabled.
 ```
 
-###### Auto generated by spf13/cobra on 2-Sep-2016
+###### Auto generated by spf13/cobra on 13-Dec-2016
-
-
-
-
 
 
 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->

docs/admin/kube-controller-manager.md

@@ -1,4 +1,6 @@
 ---
+title: kube-controller-manager
+notitle: true
 ---
 
 ## kube-controller-manager
@@ -24,7 +26,7 @@ kube-controller-manager
 ### Options
 
 ```
-      --address value                                                     The IP address to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
+      --address ip                                                        The IP address to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
       --allocate-node-cidrs                                               Should CIDRs for Pods be allocated and set on the cloud provider.
       --cloud-config string                                               The path to the cloud provider configuration file.  Empty string for no configuration file.
       --cloud-provider string                                             The provider for cloud services.  Empty string for no provider.
@@ -32,37 +34,39 @@ kube-controller-manager
       --cluster-name string                                               The instance prefix for the cluster (default "kubernetes")
       --cluster-signing-cert-file string                                  Filename containing a PEM-encoded X509 CA certificate used to issue cluster-scoped certificates (default "/etc/kubernetes/ca/ca.pem")
       --cluster-signing-key-file string                                   Filename containing a PEM-encoded RSA or ECDSA private key used to sign cluster-scoped certificates (default "/etc/kubernetes/ca/ca.key")
-      --concurrent-deployment-syncs value                                 The number of deployment objects that are allowed to sync concurrently. Larger number = more responsive deployments, but more CPU (and network) load (default 5)
+      --concurrent-deployment-syncs int32                                 The number of deployment objects that are allowed to sync concurrently. Larger number = more responsive deployments, but more CPU (and network) load (default 5)
-      --concurrent-endpoint-syncs value                                   The number of endpoint syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load (default 5)
+      --concurrent-endpoint-syncs int32                                   The number of endpoint syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load (default 5)
-      --concurrent-gc-syncs value                                         The number of garbage collector workers that are allowed to sync concurrently. (default 20)
+      --concurrent-gc-syncs int32                                         The number of garbage collector workers that are allowed to sync concurrently. (default 20)
-      --concurrent-namespace-syncs value                                  The number of namespace objects that are allowed to sync concurrently. Larger number = more responsive namespace termination, but more CPU (and network) load (default 2)
+      --concurrent-namespace-syncs int32                                  The number of namespace objects that are allowed to sync concurrently. Larger number = more responsive namespace termination, but more CPU (and network) load (default 2)
-      --concurrent-replicaset-syncs value                                 The number of replica sets that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load (default 5)
+      --concurrent-replicaset-syncs int32                                 The number of replica sets that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load (default 5)
-      --concurrent-resource-quota-syncs value                             The number of resource quotas that are allowed to sync concurrently. Larger number = more responsive quota management, but more CPU (and network) load (default 5)
+      --concurrent-resource-quota-syncs int32                             The number of resource quotas that are allowed to sync concurrently. Larger number = more responsive quota management, but more CPU (and network) load (default 5)
-      --concurrent-service-syncs value                                    The number of services that are allowed to sync concurrently. Larger number = more responsive service management, but more CPU (and network) load (default 1)
+      --concurrent-service-syncs int32                                    The number of services that are allowed to sync concurrently. Larger number = more responsive service management, but more CPU (and network) load (default 1)
-      --concurrent-serviceaccount-token-syncs value                       The number of service account token objects that are allowed to sync concurrently. Larger number = more responsive token generation, but more CPU (and network) load (default 5)
+      --concurrent-serviceaccount-token-syncs int32                       The number of service account token objects that are allowed to sync concurrently. Larger number = more responsive token generation, but more CPU (and network) load (default 5)
-      --concurrent_rc_syncs value                                         The number of replication controllers that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load (default 5)
+      --concurrent_rc_syncs int32                                         The number of replication controllers that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load (default 5)
       --configure-cloud-routes                                            Should CIDRs allocated by allocate-node-cidrs be configured on the cloud provider. (default true)
       --controller-start-interval duration                                Interval between starting controller managers.
-      --daemonset-lookup-cache-size value                                 The the size of lookup cache for daemonsets. Larger number = more responsive daemonsets, but more MEM load. (default 1024)
+      --daemonset-lookup-cache-size int32                                 The size of lookup cache for daemonsets. Larger number = more responsive daemonsets, but more MEM load. (default 1024)
       --deployment-controller-sync-period duration                        Period for syncing the deployments. (default 30s)
       --enable-dynamic-provisioning                                       Enable dynamic provisioning for environments that support it. (default true)
       --enable-garbage-collector                                          Enables the generic garbage collector. MUST be synced with the corresponding flag of the kube-apiserver. (default true)
       --enable-hostpath-provisioner                                       Enable HostPath PV provisioning when running without a cloud provider. This allows testing and development of provisioning features.  HostPath provisioning is not supported in any way, won't work in a multi-node cluster, and should not be used for anything other than testing or development.
-      --feature-gates value                                               A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --feature-gates mapStringBool                                       A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
 AllAlpha=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
 AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
+StreamingProxyRedirects=true|false (ALPHA - default=false)
       --flex-volume-plugin-dir string                                     Full path of the directory in which the flex volume plugin should search for additional third party volume plugins. (default "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/")
       --google-json-key string                                            The Google Cloud Platform Service Account JSON Key to use for authentication.
       --horizontal-pod-autoscaler-sync-period duration                    The period for syncing the number of pods in horizontal pod autoscaler. (default 30s)
       --insecure-experimental-approve-all-kubelet-csrs-for-group string   The group for which the controller-manager will auto approve all CSRs for kubelet client certificates.
-      --kube-api-burst value                                              Burst to use while talking with kubernetes apiserver (default 30)
+      --kube-api-burst int32                                              Burst to use while talking with Kubernetes apiserver (default 30)
       --kube-api-content-type string                                      Content type of requests sent to apiserver. (default "application/vnd.kubernetes.protobuf")
-      --kube-api-qps value                                                QPS to use while talking with kubernetes apiserver (default 20)
+      --kube-api-qps float32                                              QPS to use while talking with Kubernetes apiserver (default 20)
       --kubeconfig string                                                 Path to kubeconfig file with authorization and master location information.
-      --large-cluster-size-threshold value                                Number of nodes from which NodeController treats the cluster as large for the eviction logic purposes. --secondary-node-eviction-rate is implicitly overridden to 0 for clusters this size or smaller. (default 50)
+      --large-cluster-size-threshold int32                                Number of nodes from which NodeController treats the cluster as large for the eviction logic purposes. --secondary-node-eviction-rate is implicitly overridden to 0 for clusters this size or smaller. (default 50)
       --leader-elect                                                      Start a leader election client and gain leadership before executing the main loop. Enable this when running replicated components for high availability. (default true)
       --leader-elect-lease-duration duration                              The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled. (default 15s)
       --leader-elect-renew-deadline duration                              The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled. (default 10s)
@@ -70,39 +74,36 @@ DynamicVolumeProvisioning=true|false (ALPHA - default=true)
       --master string                                                     The address of the Kubernetes API server (overrides any value in kubeconfig)
       --min-resync-period duration                                        The resync period in reflectors will be random between MinResyncPeriod and 2*MinResyncPeriod (default 12h0m0s)
       --namespace-sync-period duration                                    The period for syncing namespace life-cycle updates (default 5m0s)
-      --node-cidr-mask-size value                                         Mask size for node cidr in cluster. (default 24)
+      --node-cidr-mask-size int32                                         Mask size for node cidr in cluster. (default 24)
-      --node-eviction-rate value                                          Number of nodes per second on which pods are deleted in case of node failure when a zone is healthy (see --unhealthy-zone-threshold for definition of healthy/unhealthy). Zone refers to entire cluster in non-multizone clusters. (default 0.1)
+      --node-eviction-rate float32                                        Number of nodes per second on which pods are deleted in case of node failure when a zone is healthy (see --unhealthy-zone-threshold for definition of healthy/unhealthy). Zone refers to entire cluster in non-multizone clusters. (default 0.1)
       --node-monitor-grace-period duration                                Amount of time which we allow running Node to be unresponsive before marking it unhealthy. Must be N times more than kubelet's nodeStatusUpdateFrequency, where N means number of retries allowed for kubelet to post node status. (default 40s)
       --node-monitor-period duration                                      The period for syncing NodeStatus in NodeController. (default 5s)
       --node-startup-grace-period duration                                Amount of time which we allow starting Node to be unresponsive before marking it unhealthy. (default 1m0s)
-      --node-sync-period duration                                         The period for syncing nodes from cloudprovider. Longer periods will result in fewer calls to cloud provider, but may delay addition of new nodes to cluster. (default 10s)
       --pod-eviction-timeout duration                                     The grace period for deleting pods on failed nodes. (default 5m0s)
-      --port value                                                        The port that the controller-manager's http service runs on (default 10252)
+      --port int32                                                        The port that the controller-manager's http service runs on (default 10252)
       --profiling                                                         Enable profiling via web interface host:port/debug/pprof/ (default true)
-      --pv-recycler-increment-timeout-nfs value                           the increment of time added per Gi to ActiveDeadlineSeconds for an NFS scrubber pod (default 30)
+      --pv-recycler-increment-timeout-nfs int32                           the increment of time added per Gi to ActiveDeadlineSeconds for an NFS scrubber pod (default 30)
-      --pv-recycler-minimum-timeout-hostpath value                        The minimum ActiveDeadlineSeconds to use for a HostPath Recycler pod.  This is for development and testing only and will not work in a multi-node cluster. (default 60)
+      --pv-recycler-minimum-timeout-hostpath int32                        The minimum ActiveDeadlineSeconds to use for a HostPath Recycler pod.  This is for development and testing only and will not work in a multi-node cluster. (default 60)
-      --pv-recycler-minimum-timeout-nfs value                             The minimum ActiveDeadlineSeconds to use for an NFS Recycler pod (default 300)
+      --pv-recycler-minimum-timeout-nfs int32                             The minimum ActiveDeadlineSeconds to use for an NFS Recycler pod (default 300)
       --pv-recycler-pod-template-filepath-hostpath string                 The file path to a pod definition used as a template for HostPath persistent volume recycling. This is for development and testing only and will not work in a multi-node cluster.
       --pv-recycler-pod-template-filepath-nfs string                      The file path to a pod definition used as a template for NFS persistent volume recycling
-      --pv-recycler-timeout-increment-hostpath value                      the increment of time added per Gi to ActiveDeadlineSeconds for a HostPath scrubber pod.  This is for development and testing only and will not work in a multi-node cluster. (default 30)
+      --pv-recycler-timeout-increment-hostpath int32                      the increment of time added per Gi to ActiveDeadlineSeconds for a HostPath scrubber pod.  This is for development and testing only and will not work in a multi-node cluster. (default 30)
       --pvclaimbinder-sync-period duration                                The period for syncing persistent volumes and persistent volume claims (default 15s)
-      --replicaset-lookup-cache-size value                                The the size of lookup cache for replicatsets. Larger number = more responsive replica management, but more MEM load. (default 4096)
+      --replicaset-lookup-cache-size int32                                The size of lookup cache for replicatsets. Larger number = more responsive replica management, but more MEM load. (default 4096)
-      --replication-controller-lookup-cache-size value                    The the size of lookup cache for replication controllers. Larger number = more responsive replica management, but more MEM load. (default 4096)
+      --replication-controller-lookup-cache-size int32                    The size of lookup cache for replication controllers. Larger number = more responsive replica management, but more MEM load. (default 4096)
       --resource-quota-sync-period duration                               The period for syncing quota usage status in the system (default 5m0s)
       --root-ca-file string                                               If set, this root certificate authority will be included in service account's token secret. This must be a valid PEM-encoded CA bundle.
-      --secondary-node-eviction-rate value                                Number of nodes per second on which pods are deleted in case of node failure when a zone is unhealthy (see --unhealthy-zone-threshold for definition of healthy/unhealthy). Zone refers to entire cluster in non-multizone clusters. This value is implicitly overridden to 0 if the cluster size is smaller than --large-cluster-size-threshold. (default 0.01)
+      --route-reconciliation-period duration                              The period for reconciling routes created for Nodes by cloud provider. (default 10s)
-      --service-account-private-key-file string                           Filename containing a PEM-encoded private RSA key used to sign service account tokens.
+      --secondary-node-eviction-rate float32                              Number of nodes per second on which pods are deleted in case of node failure when a zone is unhealthy (see --unhealthy-zone-threshold for definition of healthy/unhealthy). Zone refers to entire cluster in non-multizone clusters. This value is implicitly overridden to 0 if the cluster size is smaller than --large-cluster-size-threshold. (default 0.01)
+      --service-account-private-key-file string                           Filename containing a PEM-encoded private RSA or ECDSA key used to sign service account tokens.
       --service-cluster-ip-range string                                   CIDR Range for Services in cluster.
       --service-sync-period duration                                      The period for syncing services with their external load balancers (default 5m0s)
-      --terminated-pod-gc-threshold value                                 Number of terminated pods that can exist before the terminated pod garbage collector starts deleting terminated pods. If <= 0, the terminated pod garbage collector is disabled. (default 12500)
+      --terminated-pod-gc-threshold int32                                 Number of terminated pods that can exist before the terminated pod garbage collector starts deleting terminated pods. If <= 0, the terminated pod garbage collector is disabled. (default 12500)
-      --unhealthy-zone-threshold value                                    Fraction of Nodes in a zone which needs to be not Ready (minimum 3) for zone to be treated as unhealthy.  (default 0.55)
+      --unhealthy-zone-threshold float32                                  Fraction of Nodes in a zone which needs to be not Ready (minimum 3) for zone to be treated as unhealthy.  (default 0.55)
+      --use-service-account-credentials                                   If true, use individual service account credentials for each controller.
 ```
 
-###### Auto generated by spf13/cobra on 2-Sep-2016
+###### Auto generated by spf13/cobra on 13-Dec-2016
-
-
-
-
 
 
 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->

docs/admin/kube-proxy.md

@@ -1,4 +1,6 @@
 ---
+title: kube-proxy
+notitle: true
 ---
 
 ## kube-proxy
@@ -23,42 +25,42 @@ kube-proxy
 ### Options
 
 ```
-      --bind-address value                           The IP address for the proxy server to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
+      --bind-address ip                              The IP address for the proxy server to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
       --cleanup-iptables                             If true cleanup iptables rules and exit.
       --cluster-cidr string                          The CIDR range of pods in the cluster. It is used to bridge traffic coming from outside of the cluster. If not provided, no off-cluster bridging will be performed.
       --config-sync-period duration                  How often configuration from the apiserver is refreshed.  Must be greater than 0. (default 15m0s)
-      --conntrack-max value                          Maximum number of NAT connections to track (0 to leave as-is).
+      --conntrack-max-per-core int32                 Maximum number of NAT connections to track per CPU core (0 to leave the limit as-is and ignore conntrack-min). (default 32768)
-      --conntrack-max-per-core value                 Maximum number of NAT connections to track per CPU core (0 to leave as-is). This is only considered if conntrack-max is 0. (default 32768)
+      --conntrack-min int32                          Minimum number of conntrack entries to allocate, regardless of conntrack-max-per-core (set conntrack-max-per-core=0 to leave the limit as-is). (default 131072)
+      --conntrack-tcp-timeout-close-wait duration    NAT timeout for TCP connections in the CLOSE_WAIT state (default 1h0m0s)
       --conntrack-tcp-timeout-established duration   Idle timeout for established TCP connections (0 to leave as-is) (default 24h0m0s)
-      --feature-gates value                          A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --feature-gates mapStringBool                  A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
 AllAlpha=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
 AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
+StreamingProxyRedirects=true|false (ALPHA - default=false)
       --google-json-key string                       The Google Cloud Platform Service Account JSON Key to use for authentication.
-      --healthz-bind-address value                   The IP address for the health check server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) (default 127.0.0.1)
+      --healthz-bind-address ip                      The IP address for the health check server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) (default 127.0.0.1)
-      --healthz-port value                           The port to bind the health check server. Use 0 to disable. (default 10249)
+      --healthz-port int32                           The port to bind the health check server. Use 0 to disable. (default 10249)
       --hostname-override string                     If non-empty, will use this string as identification instead of the actual hostname.
-      --iptables-masquerade-bit value                If using the pure iptables proxy, the bit of the fwmark space to mark packets requiring SNAT with.  Must be within the range [0, 31]. (default 14)
+      --iptables-masquerade-bit int32                If using the pure iptables proxy, the bit of the fwmark space to mark packets requiring SNAT with.  Must be within the range [0, 31]. (default 14)
-      --iptables-sync-period duration                How often iptables rules are refreshed (e.g. '5s', '1m', '2h22m').  Must be greater than 0. (default 30s)
+      --iptables-min-sync-period duration            The minimum interval of how often the iptables rules can be refreshed as endpoints and services change (e.g. '5s', '1m', '2h22m').
-      --kube-api-burst value                         Burst to use while talking with kubernetes apiserver (default 10)
+      --iptables-sync-period duration                The maximum interval of how often iptables rules are refreshed (e.g. '5s', '1m', '2h22m').  Must be greater than 0. (default 30s)
+      --kube-api-burst int32                         Burst to use while talking with Kubernetes apiserver (default 10)
       --kube-api-content-type string                 Content type of requests sent to apiserver. (default "application/vnd.kubernetes.protobuf")
-      --kube-api-qps value                           QPS to use while talking with kubernetes apiserver (default 5)
+      --kube-api-qps float32                         QPS to use while talking with Kubernetes apiserver (default 5)
       --kubeconfig string                            Path to kubeconfig file with authorization information (the master location is set by the master flag).
       --masquerade-all                               If using the pure iptables proxy, SNAT everything
       --master string                                The address of the Kubernetes API server (overrides any value in kubeconfig)
-      --oom-score-adj value                          The oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000] (default -999)
+      --oom-score-adj int32                          The oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000] (default -999)
-      --proxy-mode value                             Which proxy mode to use: 'userspace' (older) or 'iptables' (faster). If blank, look at the Node object on the Kubernetes API and respect the 'net.experimental.kubernetes.io/proxy-mode' annotation if provided.  Otherwise use the best-available proxy (currently iptables).  If the iptables proxy is selected, regardless of how, but the system's kernel or iptables versions are insufficient, this always falls back to the userspace proxy.
+      --proxy-mode ProxyMode                         Which proxy mode to use: 'userspace' (older) or 'iptables' (faster). If blank, look at the Node object on the Kubernetes API and respect the 'net.experimental.kubernetes.io/proxy-mode' annotation if provided.  Otherwise use the best-available proxy (currently iptables).  If the iptables proxy is selected, regardless of how, but the system's kernel or iptables versions are insufficient, this always falls back to the userspace proxy.
-      --proxy-port-range value                       Range of host ports (beginPort-endPort, inclusive) that may be consumed in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.
+      --proxy-port-range port-range                  Range of host ports (beginPort-endPort, inclusive) that may be consumed in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.
       --udp-timeout duration                         How long an idle UDP connection will be kept open (e.g. '250ms', '2s').  Must be greater than 0. Only applicable for proxy-mode=userspace (default 250ms)
 ```
 
-###### Auto generated by spf13/cobra on 2-Sep-2016
+###### Auto generated by spf13/cobra on 13-Dec-2016
-
-
-
-
 
 
 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->

docs/admin/kube-scheduler.md

@@ -1,4 +1,6 @@
 ---
+title: kube-scheduler
+notitle: true
 ---
 
 ## kube-scheduler
@@ -24,19 +26,21 @@ kube-scheduler
 
 ```
       --address string                           The IP address to serve on (set to 0.0.0.0 for all interfaces) (default "0.0.0.0")
-      --algorithm-provider string                The scheduling algorithm provider to use, one of: DefaultProvider | ClusterAutoscalerProvider (default "DefaultProvider")
+      --algorithm-provider string                The scheduling algorithm provider to use, one of: ClusterAutoscalerProvider | DefaultProvider (default "DefaultProvider")
       --failure-domains string                   Indicate the "all topologies" set for an empty topologyKey when it's used for PreferredDuringScheduling pod anti-affinity. (default "kubernetes.io/hostname,failure-domain.beta.kubernetes.io/zone,failure-domain.beta.kubernetes.io/region")
-      --feature-gates value                      A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --feature-gates mapStringBool              A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+AllAlpha=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
+AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
-AllAlpha=true|false (ALPHA - default=false)
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+StreamingProxyRedirects=true|false (ALPHA - default=false)
-AppArmor=true|false (BETA - default=true)
       --google-json-key string                   The Google Cloud Platform Service Account JSON Key to use for authentication.
       --hard-pod-affinity-symmetric-weight int   RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule corresponding to every RequiredDuringScheduling affinity rule. --hard-pod-affinity-symmetric-weight represents the weight of implicit PreferredDuringScheduling affinity rule. (default 1)
-      --kube-api-burst value                     Burst to use while talking with kubernetes apiserver (default 100)
+      --kube-api-burst int32                     Burst to use while talking with Kubernetes apiserver (default 100)
       --kube-api-content-type string             Content type of requests sent to apiserver. (default "application/vnd.kubernetes.protobuf")
-      --kube-api-qps value                       QPS to use while talking with kubernetes apiserver (default 50)
+      --kube-api-qps float32                     QPS to use while talking with Kubernetes apiserver (default 50)
       --kubeconfig string                        Path to kubeconfig file with authorization and master location information.
       --leader-elect                             Start a leader election client and gain leadership before executing the main loop. Enable this when running replicated components for high availability. (default true)
       --leader-elect-lease-duration duration     The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled. (default 15s)
@@ -44,16 +48,12 @@ AppArmor=true|false (BETA - default=true)
       --leader-elect-retry-period duration       The duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled. (default 2s)
       --master string                            The address of the Kubernetes API server (overrides any value in kubeconfig)
       --policy-config-file string                File with scheduler policy configuration
-      --port value                               The port that the scheduler's http service runs on (default 10251)
+      --port int32                               The port that the scheduler's http service runs on (default 10251)
       --profiling                                Enable profiling via web interface host:port/debug/pprof/ (default true)
       --scheduler-name string                    Name of the scheduler, used to select which pods will be processed by this scheduler, based on pod's annotation with key 'scheduler.alpha.kubernetes.io/name' (default "default-scheduler")
 ```
 
-###### Auto generated by spf13/cobra on 2-Sep-2016
+###### Auto generated by spf13/cobra on 13-Dec-2016
-
-
-
-
 
 
 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->

docs/admin/kubeadm.md

@@ -0,0 +1,261 @@
+---
+assignees:
+- mikedanese
+- luxas
+- errordeveloper
+- jbeda
+title: kubeadm reference
+---
+
+This document provides information on how to use kubeadm's advanced options.
+
+Running `kubeadm init` bootstraps a Kubernetes cluster. This consists of the
+following steps:
+
+1. kubeadm runs a series of pre-flight checks to validate the system state
+before making changes. Some checks only trigger warnings, others are
+considered errors and will exit kubeadm until the problem is corrected or
+the user specifies `--skip-preflight-checks`.
+
+1. kubeadm generates a token that additional nodes can use to register
+themselves with the master in future.  Optionally, the user can provide a token.
+
+1. kubeadm generates a self-signed CA using openssl to provision identities
+for each node in the cluster, and for the API server to secure communication
+with clients.
+
+1. Outputting a kubeconfig file for the kubelet to use to connect to the API
+server, as well as an additional kubeconfig file for administration.
+
+1. kubeadm generates Kubernetes resource manifests for the API server,
+controller manager and scheduler, and placing them in
+`/etc/kubernetes/manifests`. The kubelet watches this directory for static
+resources to create on startup. These are the core components of Kubernetes, and
+once they are up and running we can use `kubectl` to set up/manage any
+additional components.
+
+1. kubeadm installs any add-on components, such as DNS or discovery, via the API
+server.
+
+Running `kubeadm join` on each node in the cluster consists of the following steps:
+
+1. Use the token to talk to the API server and securely get the root CA
+certificate.
+
+1. Creates a local key pair.  Prepares a certificate signing request (CSR) and
+sends that off to the API server for signing.
+
+1. Configures the local kubelet to connect to the API server
+
+## Usage
+
+Fields that support multiple values do so either with comma separation, or by specifying
+the flag multiple times.
+
+### `kubeadm init`
+
+It is usually sufficient to run `kubeadm init` without any flags,
+but in some cases you might like to override the default behaviour.
+Here we specify all the flags that can be used to customise the Kubernetes
+installation.
+
+- `--api-advertise-addresses` (multiple values are allowed)
+- `--api-external-dns-names` (multiple values are allowed)
+
+By default, `kubeadm init` automatically detects IP addresses and uses
+these to generate certificates for the API server. This uses the IP address
+of the default network interface. If you would like to access the API server
+through a different IP address, or through a hostname, you can override these
+defaults with `--api-advertise-addresses` and `--api-external-dns-names`.
+For example, to generate certificates that verify the API server at addresses
+`10.100.245.1` and `100.123.121.1`, you could use
+`--api-advertise-addresses=10.100.245.1,100.123.121.1`. To allow it to be accessed
+with a hostname, `--api-external-dns-names=kubernetes.example.com,kube.example.com`
+Specifying `--api-advertise-addresses` disables auto detection of IP addresses.
+
+- `--cloud-provider`
+
+Currently, `kubeadm init` does not provide autodetection of cloud provider.
+This means that load balancing and persistent volumes are not supported out
+of the box. You can specify a cloud provider using `--cloud-provider`.
+Valid values are the ones supported by `controller-manager`, namely `"aws"`,
+`"azure"`, `"cloudstack"`, `"gce"`, `"mesos"`, `"openstack"`, `"ovirt"`,
+`"rackspace"`, `"vsphere"`. In order to provide additional configuration for
+the cloud provider, you should create a `/etc/kubernetes/cloud-config`
+file manually, before running `kubeadm init`. `kubeadm` automatically
+picks those settings up and ensures other nodes are configured correctly.
+You must also set the `--cloud-provider` and `--cloud-config` parameters
+yourself by editing the `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf`
+file appropriately.
+
+- `--external-etcd-cafile` etcd certificate authority file
+- `--external-etcd-endpoints` (multiple values are allowed)
+- `--external-etcd-certfile` etcd client certificate file
+- `--external-etcd-keyfile` etcd client key file
+
+By default, `kubeadm` deploys a single node etcd cluster on the master
+to store Kubernetes state. This means that any failure on the master node
+requires you to rebuild your cluster from scratch. Currently `kubeadm init`
+does not support automatic deployment of a highly available etcd cluster.
+If you would like to use your own etcd cluster, you can override this
+behaviour with `--external-etcd-endpoints`. `kubeadm` supports etcd client
+authentication using the `--external-etcd-cafile`, `--external-etcd-certfile`
+and `--external-etcd-keyfile` flags.
+
+- `--pod-network-cidr`
+
+For certain networking solutions the Kubernetes master can also play a role in
+allocating network ranges (CIDRs) to each node. This includes many cloud providers
+and flannel. You can specify a subnet range that will be broken down and handed out
+to each node with the `--pod-network-cidr` flag. This should be a minimum of a /16 so
+controller-manager is able to assign /24 subnets to each node in the cluster.
+If you are using flannel with [this manifest](https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml)
+you should use `--pod-network-cidr=10.244.0.0/16`. Most CNI based networking solutions
+do not require this flag.
+
+- `--service-cidr` (default '10.96.0.0/12')
+
+You can use the `--service-cidr` flag to override the subnet Kubernetes uses to
+assign pods IP addresses. If you do, you will also need to update the
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` file to reflect this change
+else DNS will not function correctly.
+
+- `--service-dns-domain` (default 'cluster.local')
+
+By default, `kubeadm init` deploys a cluster that assigns services with DNS names
+`<service_name>.<namespace>.svc.cluster.local`. You can use the `--service-dns-domain`
+to change the DNS name suffix. Again, you will need to update the
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` file accordingly else DNS will
+not function correctly.
+
+- `--skip-preflight-checks`
+
+By default, `kubeadm` runs a series of preflight checks to validate the system
+before making any changes. Advanced users can use this flag to bypass these if
+necessary.
+
+- `--token`
+
+By default, `kubeadm init` automatically generates the token used to initialise
+each new node. If you would like to manually specify this token, you can use the
+`--token` flag. The token must be of the format `<6 character string>.<16 character string>`.
+
+- `--use-kubernetes-version` (default 'v1.5.1') the kubernetes version to initialise
+
+`kubeadm` was originally built for Kubernetes version **v1.4.0**, older versions are not
+supported. With this flag you can try any future version, e.g. **v1.6.0-beta.1**
+whenever it comes out (check [releases page](https://github.com/kubernetes/kubernetes/releases)
+for a full list of available versions).
+
+### `kubeadm join`
+
+When you use kubeadm join, you must supply the token used to secure cluster
+boostrap as a mandatory flag, and the master IP address as a mandatory argument.
+
+Here's an example on how to use it:
+
+`kubeadm join --token=the_secret_token 192.168.1.1`
+
+- `--skip-preflight-checks`
+
+By default, `kubeadm` runs a series of preflight checks to validate the system
+before making any changes. Advanced users can use this flag to bypass these if
+necessary.
+
+- `--token=<token>`
+
+By default, when `kubeadm init` runs, a token is generated and revealed in the output.
+That's the token you should use here.
+
+
+## Using kubeadm with a configuration file
+
+WARNING: kubeadm is in alpha and the configuration API syntax will likely change before GA.
+
+It's possible to configure kubeadm with a configuration file instead of command line flags, and some more advanced features may only be
+available as configuration file options.
+
+### Sample Master Configuration
+
+    ```yaml
+    apiVersion: kubeadm.k8s.io/v1alpha1
+    kind: MasterConfiguration
+    api:
+      advertiseAddresses:
+      - <address1|string>
+      - <address2|string>
+      bindPort: <int>
+      externalDNSNames:
+      - <dnsname1|string>
+      - <dnsname2|string>
+    cloudProvider: <string>
+    discovery:
+      bindPort: <int>
+    etcd:
+      endpoints:
+      - <endpoint1|string>
+      - <endpoint2|string>
+      caFile: <path|string>
+      certFile: <path|string>
+      keyFile: <path|string>
+    kubernetesVersion: <string>
+    networking:
+      dnsDomain: <string>
+      serviceSubnet: <cidr>
+      podSubnet: <cidr>
+    secrets:
+      givenToken: <token|string>
+    ```
+
+### Sample Node Configuration
+
+    ```yaml
+    apiVersion: kubeadm.k8s.io/v1alpha1
+    kind: NodeConfiguration
+    apiPort: <int>
+    discoveryPort: <int>
+    masterAddresses:
+    - <master1>
+    secrets:
+      givenToken: <token|string>
+    ```
+
+## Automating kubeadm
+
+Rather than copying the token you obtained from `kubeadm init` to each node, as
+in the basic `kubeadm` tutorials, you can parallelize the token distribution for
+easier automation. To implement this automation, you must know the IP address
+that the master will have after it is started.
+
+1.  Generate a token.  This token must have the form  `<6 character string>.<16 character string>`.
+
+    Kubeadm can pre-generate a token for you:
+
+    ```console
+    $ kubeadm token generate
+    ```
+
+1. Start both the master node and the worker nodes concurrently with this token.  As they come up they should find each other and form the cluster.
+
+Once the cluster is up, you can grab the admin credentials from the master node at `/etc/kubernetes/admin.conf` and use that to talk to the cluster.
+
+## Environment variables
+
+There are some environment variables that modify the way that `kubeadm` works.  Most users will have no need to set these.
+These environment variables are a short-term solution, eventually they will be integrated in the kubeadm configuration file.
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| `KUBE_KUBERNETES_DIR` | `/etc/kubernetes` | Where most configuration files are written to and read from |
+| `KUBE_HOST_PKI_PATH` | `/etc/kubernetes/pki` | Directory for master PKI assets |
+| `KUBE_HOST_ETCD_PATH` | `/var/lib/etcd` | Local etcd state for Kubernetes cluster |
+| `KUBE_HYPERKUBE_IMAGE` | `` | If set, use a single hyperkube image with this name. If not set, individual images per server component will be used. |
+| `KUBE_DISCOVERY_IMAGE` | `gcr.io/google_containers/kube-discovery-<arch>:1.0` | The bootstrap discovery helper image to use. |
+| `KUBE_ETCD_IMAGE` | `gcr.io/google_containers/etcd-<arch>:2.2.5` | The etcd container image to use. |
+| `KUBE_REPO_PREFIX` | `gcr.io/google_containers` | The image prefix for all images that are used. |
+
+## Releases and release notes
+
+If you already have kubeadm installed and want to upgrade, run `apt-get update && apt-get upgrade` or `yum update` to get the latest version of kubeadm.
+
+Refer to the [CHANGELOG.md](https://github.com/kubernetes/kubeadm/blob/master/CHANGELOG.md) for more information.

docs/admin/kubelet-authentication-authorization.md

@@ -0,0 +1,87 @@
+---
+assignees:
+- liggitt
+title: Kubelet authentication/authorization
+---
+
+* TOC
+{:toc}
+
+## Overview
+
+A kubelet's HTTPS endpoint exposes APIs which give access to data of varying sensitivity,
+and allow you to perform operations with varying levels of power on the node and within containers.
+
+This document describes how to authenticate and authorize access to the kubelet's HTTPS endpoint.
+
+## Kubelet authentication
+
+By default, requests to the kubelet's HTTPS endpoint that are not rejected by other configured
+authentication methods are treated as anonymous requests, and given a username of `system:anonymous`
+and a group of `system:unauthenticated`.
+
+To disable anonymous access and send `401 Unauthorized` responses to unauthenticated requests:
+
+* start the kubelet with the `--anonymous-auth=false` flag
+
+To enable X509 client certificate authentication to the kubelet's HTTPS endpoint:
+
+* start the kubelet with the `--client-ca-file` flag, providing a CA bundle to verify client certificates with
+* start the apiserver with `--kubelet-client-certificate` and `--kubelet-client-key` flags
+* see the [apiserver authentication documentation](/docs/admin/authentication/#x509-client-certs) for more details
+
+To enable API bearer tokens (including service account tokens) to be used to authenticate to the kubelet's HTTPS endpoint:
+
+* ensure the `authentication.k8s.io/v1beta1` API group is enabled in the API server
+* start the kubelet with the `--authentication-token-webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
+* the kubelet calls the `TokenReview` API on the configured API server to determine user information from bearer tokens
+
+## Kubelet authorization
+
+Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is `AlwaysAllow`, which allows all requests.
+
+There are many possible reasons to subdivide access to the kubelet API:
+
+* anonymous auth is enabled, but anonymous users' ability to call the kubelet API should be limited
+* bearer token auth is enabled, but arbitrary API users' (like service accounts) ability to call the kubelet API should be limited
+* client certificate auth is enabled, but only some of the client certificates signed by the configured CA should be allowed to use the kubelet API
+
+To subdivide access to the kubelet API, delegate authorization to the API server:
+
+* ensure the `authorization.k8s.io/v1beta1` API group is enabled in the API server
+* start the kubelet with the `--authorization-mode=Webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
+* the kubelet calls the `SubjectAccessReview` API on the configured API server to determine whether each request is authorized
+
+The kubelet authorizes API requests using the same [request attributes](/docs/admin/authorization/#request-attributes) approach as the apiserver.
+
+The verb is determined from the incoming request's HTTP verb:
+
+HTTP verb | request verb
+----------|---------------
+POST      | create
+GET, HEAD | get
+PUT       | update
+PATCH     | patch
+DELETE    | delete
+
+The resource and subresource is determined from the incoming request's path:
+
+Kubelet API  | resource | subresource
+-------------|----------|------------
+/stats/\*     | nodes    | stats
+/metrics/\*   | nodes    | metrics
+/logs/\*      | nodes    | log
+/spec/\*      | nodes    | spec
+*all others* | nodes    | proxy
+
+The namespace and API group attributes are always an empty string, and
+the resource name is always the name of the kubelet's `Node` API object.
+
+When running in this mode, ensure the user identified by the `--kubelet-client-certificate` and `--kubelet-client-key`
+flags passed to the apiserver is authorized for the following attributes:
+
+* verb=\*, resource=nodes, subresource=proxy
+* verb=\*, resource=nodes, subresource=stats
+* verb=\*, resource=nodes, subresource=log
+* verb=\*, resource=nodes, subresource=spec
+* verb=\*, resource=nodes, subresource=metrics

docs/admin/kubelet-tls-bootstrapping.md

@@ -0,0 +1,96 @@
+---
+assignees:
+- mikedanese
+title: TLS bootstrapping
+---
+
+* TOC
+{:toc}
+
+## Overview
+
+This document describes how to set up TLS client certificate bootstrapping for kubelets.
+Kubernetes 1.4 introduces an experimental API for requesting certificates from a cluster-level 
+Certificate Authority (CA). The first supported use of this API is the provisioning of TLS client 
+certificates for kubelets. The proposal can be found [here](https://github.com/kubernetes/kubernetes/pull/20439)
+and progress on the feature is being tracked as [feature #43](https://github.com/kubernetes/features/issues/43). 
+
+## apiserver configuration
+
+You must provide a token file which specifies at least one "bootstrap token" assigned to a kubelet bootstrap-specific group.
+This group will later be used in the controller-manager configuration to scope approvals in the default approval
+controller. As this feature matures, you should ensure tokens are bound to an RBAC policy which limits requests
+using the bootstrap token to only be able to make requests related to certificate provisioning. When RBAC policy
+is in place, scoping the tokens to a group will allow great flexibility (e.g. you could disable a particular
+bootstrap group's access when you are done provisioning the nodes). 
+
+### Token auth file 
+Tokens are arbitrary but should represent at least 128 bits of entropy derived from a secure random number 
+generator (such as /dev/urandom on most modern systems). There are multiple ways you can generate a token. For example: 
+
+`head -c 16 /dev/urandom | od -An -t x | tr -d ' '` 
+
+will generate tokens that look like `02b50b05283e98dd0fd71db496ef01e8` 
+
+The token file will look like the following example, where the first three values can be anything and the quoted group 
+name should be as depicted: 
+
+```
+02b50b05283e98dd0fd71db496ef01e8,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
+``` 
+
+Add the `--token-auth-file=FILENAME` flag to the apiserver command to enable the token file. 
+See docs at http://kubernetes.io/docs/admin/authentication/#static-token-file for further details.
+
+### Client certificate CA bundle
+
+Add the `--client-ca-file=FILENAME` flag to the apiserver command to enable client certificate authentication,
+referencing a certificate authority bundle containing the signing certificate.
+
+## controller-manager configuration
+The API for requesting certificates adds a certificate-issuing control loop to the KCM. This takes the form of a 
+[cfssl](https://blog.cloudflare.com/introducing-cfssl/) local signer using assets on disk. 
+Currently, all certificates issued have one year validity and a default set of key usages. 
+
+### Signing assets 
+You must provide a Certificate Authority in order to provide the cryptographic materials necessary to issue certificates. 
+This CA should be trusted by the apiserver for authentication with the `--client-ca-file=SOMEFILE` flag. The management
+of the CA is beyond the scope of this document but it is recommended that you generate a dedicated CA for Kubernetes.
+Both certificate and key are assumed to be PEM-encoded. 
+
+The new controller-manager flags are: 
+```
+--cluster-signing-cert-file="/etc/path/to/kubernetes/ca/ca.crt" --cluster-signing-key-file="/etc/path/to/kubernetes/ca/ca.key"
+``` 
+
+### Auto-approval 
+To ease deployment and testing, the alpha version of the certificate request API includes a flag to approve all certificate 
+requests made by users in a certain group. The intended use of this is to whitelist only the group corresponding to the bootstrap
+token in the token file above. Use of this flag circumvents makes the "approval" process described below and is not recommended
+for production use. 
+
+The flag is: 
+```
+--insecure-experimental-approve-all-kubelet-csrs-for-group="system:kubelet-bootstrap"
+``` 
+
+## kubelet configuration 
+To use request a client cert from the certificate request API, the kubelet needs a path to a kubeconfig file that contains the
+bootstrap auth token. If the file specified by `--kubeconfig` does not exist, the bootstrap kubeconfig is used to request a
+client certificate from the API server. On success, a kubeconfig file referencing the generated key and obtained certificate
+is written to the path specified by `--kubeconfig`. The certificate and key file will be stored in the directory pointed 
+by `--cert-dir`.  The new flag is: 
+
+```
+--experimental-bootstrap-kubeconfig="/path/to/bootstrap/kubeconfig"
+``` 
+
+## kubectl approval 
+The signing controller does not immediately sign all certificate requests. Instead, it waits until they have been flagged with an 
+"Approved" status by an appropriately-privileged user. This is intended to eventually be an automated process handled by an external
+approval controller, but for the alpha version of the API it can be done manually by a cluster administrator using kubectl. 
+An administrator can list CSRs with `kubectl get csr`, describe one in detail with `kubectl describe <name>`. There are 
+[currently no direct approve/deny commands](https://github.com/kubernetes/kubernetes/issues/30163) so an approver will need to update
+the Status field directly. A rough example of how to do this in bash which should only be used until the porcelain merges is available
+at [https://github.com/gtank/csrctl](https://github.com/gtank/csrctl).
+

docs/admin/kubelet.md

@@ -1,4 +1,6 @@
 ---
+title: Overview
+notitle: true
 ---
 
 ## kubelet
@@ -15,7 +17,7 @@ various mechanisms (primarily through the apiserver) and ensures that the contai
 described in those PodSpecs are running and healthy. The kubelet doesn't manage
 containers which were not created by Kubernetes.
 
-Other than from an PodSpec from the apiserver, there are three ways that a container
+Other than from a PodSpec from the apiserver, there are three ways that a container
 manifest can be provided to the Kubelet.
 
 File: Path passed as a flag on the command line. This file is rechecked every 20
@@ -34,123 +36,134 @@ kubelet
 ### Options
 
 ```
-      --address value                                  The IP address for the Kubelet to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
+      --address ip                                              The IP address for the Kubelet to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
-      --allow-privileged                               If true, allow containers to request privileged mode. [default=false]
+      --allow-privileged                                        If true, allow containers to request privileged mode. [default=false]
-      --cadvisor-port value                            The port of the localhost cAdvisor endpoint (default 4194)
+      --anonymous-auth                                          Enables anonymous requests to the Kubelet server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated. (default true)
-      --cert-dir string                                The directory where the TLS certs are located (by default /var/run/kubernetes). If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored. (default "/var/run/kubernetes")
+      --authentication-token-webhook                            Use the TokenReview API to determine authentication for bearer tokens.
-      --cgroup-root string                             Optional root cgroup to use for pods. This is handled by the container runtime on a best effort basis. Default: '', which means use the container runtime default.
+      --authentication-token-webhook-cache-ttl duration         The duration to cache responses from the webhook token authenticator. (default 2m0s)
-      --chaos-chance float                             If > 0.0, introduce random client errors and latency. Intended for testing. [default=0.0]
+      --authorization-mode string                               Authorization mode for Kubelet server. Valid options are AlwaysAllow or Webhook. Webhook mode uses the SubjectAccessReview API to determine authorization. (default "AlwaysAllow")
-      --cloud-config string                            The path to the cloud provider configuration file.  Empty string for no configuration file.
+      --authorization-webhook-cache-authorized-ttl duration     The duration to cache 'authorized' responses from the webhook authorizer. (default 5m0s)
-      --cloud-provider string                          The provider for cloud services. By default, kubelet will attempt to auto-detect the cloud provider. Specify empty string for running with no cloud provider. [default=auto-detect] (default "auto-detect")
+      --authorization-webhook-cache-unauthorized-ttl duration   The duration to cache 'unauthorized' responses from the webhook authorizer. (default 30s)
-      --cluster-dns string                             IP address for a cluster DNS server.  This value is used for containers' DNS server in case of Pods with "dnsPolicy=ClusterFirst"
+      --cadvisor-port int32                                     The port of the localhost cAdvisor endpoint (default 4194)
-      --cluster-domain string                          Domain for this cluster.  If set, kubelet will configure all containers to search this domain in addition to the host's search domains
+      --cert-dir string                                         The directory where the TLS certs are located (by default /var/run/kubernetes). If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored. (default "/var/run/kubernetes")
-      --configure-cbr0                                 If true, kubelet will configure cbr0 based on Node.Spec.PodCIDR.
+      --cgroup-driver string                                    Driver that the kubelet uses to manipulate cgroups on the host.  Possible values: 'cgroupfs', 'systemd' (default "cgroupfs")
-      --container-runtime string                       The container runtime to use. Possible values: 'docker', 'rkt'. Default: 'docker'. (default "docker")
+      --cgroup-root string                                      Optional root cgroup to use for pods. This is handled by the container runtime on a best effort basis. Default: '', which means use the container runtime default.
-      --container-runtime-endpoint string              The unix socket endpoint of remote runtime service. If not empty, this option will override --container-runtime. This is an experimental feature. Intended for testing only.
+      --chaos-chance float                                      If > 0.0, introduce random client errors and latency. Intended for testing. [default=0.0]
-      --containerized                                  Experimental support for running kubelet in a container.  Intended for testing. [default=false]
+      --client-ca-file string                                   If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.
-      --cpu-cfs-quota                                  Enable CPU CFS quota enforcement for containers that specify CPU limits (default true)
+      --cloud-config string                                     The path to the cloud provider configuration file.  Empty string for no configuration file.
-      --docker-endpoint string                         Use this for the docker endpoint to communicate with (default "unix:///var/run/docker.sock")
+      --cloud-provider string                                   The provider for cloud services. By default, kubelet will attempt to auto-detect the cloud provider. Specify empty string for running with no cloud provider. [default=auto-detect] (default "auto-detect")
-      --docker-exec-handler string                     Handler to use when executing a command in a container. Valid values are 'native' and 'nsenter'. Defaults to 'native'. (default "native")
+      --cluster-dns string                                      IP address for a cluster DNS server.  This value is used for containers' DNS server in case of Pods with "dnsPolicy=ClusterFirst"
-      --enable-controller-attach-detach                Enables the Attach/Detach controller to manage attachment/detachment of volumes scheduled to this node, and disables kubelet from executing any attach/detach operations (default true)
+      --cluster-domain string                                   Domain for this cluster.  If set, kubelet will configure all containers to search this domain in addition to the host's search domains
-      --enable-custom-metrics                          Support for gathering custom metrics.
+      --cni-bin-dir string                                      <Warning: Alpha feature> The full path of the directory in which to search for CNI plugin binaries. Default: /opt/cni/bin
-      --enable-debugging-handlers                      Enables server endpoints for log collection and local running of containers and commands (default true)
+      --cni-conf-dir string                                     <Warning: Alpha feature> The full path of the directory in which to search for CNI config files. Default: /etc/cni/net.d
-      --enable-server                                  Enable the Kubelet's server (default true)
+      --container-runtime string                                The container runtime to use. Possible values: 'docker', 'rkt'. Default: 'docker'. (default "docker")
-      --event-burst value                              Maximum size of a bursty event records, temporarily allows event records to burst to this number, while still not exceeding event-qps. Only used if --event-qps > 0 (default 10)
+      --container-runtime-endpoint string                       [Experimental] The unix socket endpoint of remote runtime service. The endpoint is used only when CRI integration is enabled (--experimental-cri)
-      --event-qps value                                If > 0, limit event creations per second to this value. If 0, unlimited. (default 5)
+      --containerized                                           Experimental support for running kubelet in a container.  Intended for testing. [default=false]
-      --eviction-hard string                           A set of eviction thresholds (e.g. memory.available<1Gi) that if met would trigger a pod eviction. (default "memory.available<100Mi")
+      --cpu-cfs-quota                                           Enable CPU CFS quota enforcement for containers that specify CPU limits (default true)
-      --eviction-max-pod-grace-period value            Maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met.  If negative, defer to pod specified value.
+      --docker-endpoint string                                  Use this for the docker endpoint to communicate with (default "unix:///var/run/docker.sock")
-      --eviction-minimum-reclaim string                A set of minimum reclaims (e.g. imagefs.available=2Gi) that describes the minimum amount of resource the kubelet will reclaim when performing a pod eviction if that resource is under pressure.
+      --docker-exec-handler string                              Handler to use when executing a command in a container. Valid values are 'native' and 'nsenter'. Defaults to 'native'. (default "native")
-      --eviction-pressure-transition-period duration   Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. (default 5m0s)
+      --enable-controller-attach-detach                         Enables the Attach/Detach controller to manage attachment/detachment of volumes scheduled to this node, and disables kubelet from executing any attach/detach operations (default true)
-      --eviction-soft string                           A set of eviction thresholds (e.g. memory.available<1.5Gi) that if met over a corresponding grace period would trigger a pod eviction.
+      --enable-custom-metrics                                   Support for gathering custom metrics.
-      --eviction-soft-grace-period string              A set of eviction grace periods (e.g. memory.available=1m30s) that correspond to how long a soft eviction threshold must hold before triggering a pod eviction.
+      --enable-debugging-handlers                               Enables server endpoints for log collection and local running of containers and commands (default true)
-      --exit-on-lock-contention                        Whether kubelet should exit upon lock-file contention.
+      --enable-server                                           Enable the Kubelet's server (default true)
-      --experimental-allowed-unsafe-sysctls value      Comma-separated whitelist of unsafe sysctls or unsafe sysctl patterns (ending in *). Use these at your own risk. (default [])
+      --event-burst int32                                       Maximum size of a bursty event records, temporarily allows event records to burst to this number, while still not exceeding event-qps. Only used if --event-qps > 0 (default 10)
-      --experimental-bootstrap-kubeconfig string       <Warning: Experimental feature> Path to a kubeconfig file that will be used to get client certificate for kubelet. If the file specified by --kubeconfig does not exist, the bootstrap kubeconfig is used to request a client certificate from the API server. On success, a kubeconfig file referencing the generated key and obtained certificate is written to the path specified by --kubeconfig. The certificate and key file will be stored in the directory pointed by --cert-dir.
+      --event-qps int32                                         If > 0, limit event creations per second to this value. If 0, unlimited. (default 5)
-      --experimental-flannel-overlay                   Experimental support for starting the kubelet with the default overlay network (flannel). Assumes flanneld is already running in client mode. [default=false]
+      --eviction-hard string                                    A set of eviction thresholds (e.g. memory.available<1Gi) that if met would trigger a pod eviction. (default "memory.available<100Mi")
-      --experimental-nvidia-gpus value                 Number of NVIDIA GPU devices on this node. Only 0 (default) and 1 are currently supported.
+      --eviction-max-pod-grace-period int32                     Maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met.  If negative, defer to pod specified value.
-      --feature-gates value                            A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --eviction-minimum-reclaim string                         A set of minimum reclaims (e.g. imagefs.available=2Gi) that describes the minimum amount of resource the kubelet will reclaim when performing a pod eviction if that resource is under pressure.
+      --eviction-pressure-transition-period duration            Duration for which the kubelet has to wait before transitioning out of an eviction pressure condition. (default 5m0s)
+      --eviction-soft string                                    A set of eviction thresholds (e.g. memory.available<1.5Gi) that if met over a corresponding grace period would trigger a pod eviction.
+      --eviction-soft-grace-period string                       A set of eviction grace periods (e.g. memory.available=1m30s) that correspond to how long a soft eviction threshold must hold before triggering a pod eviction.
+      --exit-on-lock-contention                                 Whether kubelet should exit upon lock-file contention.
+      --experimental-allowed-unsafe-sysctls stringSlice         Comma-separated whitelist of unsafe sysctls or unsafe sysctl patterns (ending in *). Use these at your own risk.
+      --experimental-bootstrap-kubeconfig string                <Warning: Experimental feature> Path to a kubeconfig file that will be used to get client certificate for kubelet. If the file specified by --kubeconfig does not exist, the bootstrap kubeconfig is used to request a client certificate from the API server. On success, a kubeconfig file referencing the generated key and obtained certificate is written to the path specified by --kubeconfig. The certificate and key file will be stored in the directory pointed by --cert-dir.
+      --experimental-cgroups-per-qos                            Enable creation of QoS cgroup hierarchy, if true top level QoS and pod cgroups are created.
+      --experimental-check-node-capabilities-before-mount       [Experimental] if set true, the kubelet will check the underlying node for required components (binaries, etc.) before performing the mount
+      --experimental-cri                                        [Experimental] Enable the Container Runtime Interface (CRI) integration. If --container-runtime is set to "remote", Kubelet will communicate with the runtime/image CRI server listening on the endpoint specified by --remote-runtime-endpoint/--remote-image-endpoint. If --container-runtime is set to "docker", Kubelet will launch a in-process CRI server on behalf of docker, and communicate over a default endpoint.
+      --experimental-fail-swap-on                               Makes the Kubelet fail to start if swap is enabled on the node. This is a temporary option to maintain legacy behavior, failing due to swap enabled will happen by default in v1.6.
+      --experimental-kernel-memcg-notification                  If enabled, the kubelet will integrate with the kernel memcg notification to determine if memory eviction thresholds are crossed rather than polling.
+      --experimental-mounter-path string                        [Experimental] Path of mounter binary. Leave empty to use the default mount.
+      --experimental-nvidia-gpus int32                          Number of NVIDIA GPU devices on this node. Only 0 (default) and 1 are currently supported.
+      --feature-gates string                                    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
 AllAlpha=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
 AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
-      --file-check-frequency duration                  Duration between checking config files for new data (default 20s)
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
-      --google-json-key string                         The Google Cloud Platform Service Account JSON Key to use for authentication.
+StreamingProxyRedirects=true|false (ALPHA - default=false)
-      --hairpin-mode string                            How should the kubelet setup hairpin NAT. This allows endpoints of a Service to loadbalance back to themselves if they should try to access their own Service. Valid values are "promiscuous-bridge", "hairpin-veth" and "none". (default "promiscuous-bridge")
+      --file-check-frequency duration                           Duration between checking config files for new data (default 20s)
-      --healthz-bind-address value                     The IP address for the healthz server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) (default 127.0.0.1)
+      --google-json-key string                                  The Google Cloud Platform Service Account JSON Key to use for authentication.
-      --healthz-port value                             The port of the localhost healthz endpoint (default 10248)
+      --hairpin-mode string                                     How should the kubelet setup hairpin NAT. This allows endpoints of a Service to loadbalance back to themselves if they should try to access their own Service. Valid values are "promiscuous-bridge", "hairpin-veth" and "none". (default "promiscuous-bridge")
-      --host-ipc-sources value                         Comma-separated list of sources from which the Kubelet allows pods to use the host ipc namespace. [default="*"] (default [*])
+      --healthz-bind-address ip                                 The IP address for the healthz server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) (default 127.0.0.1)
-      --host-network-sources value                     Comma-separated list of sources from which the Kubelet allows pods to use of host network. [default="*"] (default [*])
+      --healthz-port int32                                      The port of the localhost healthz endpoint (default 10248)
-      --host-pid-sources value                         Comma-separated list of sources from which the Kubelet allows pods to use the host pid namespace. [default="*"] (default [*])
+      --host-ipc-sources stringSlice                            Comma-separated list of sources from which the Kubelet allows pods to use the host ipc namespace. [default="*"] (default [*])
-      --hostname-override string                       If non-empty, will use this string as identification instead of the actual hostname.
+      --host-network-sources stringSlice                        Comma-separated list of sources from which the Kubelet allows pods to use of host network. [default="*"] (default [*])
-      --http-check-frequency duration                  Duration between checking http for new data (default 20s)
+      --host-pid-sources stringSlice                            Comma-separated list of sources from which the Kubelet allows pods to use the host pid namespace. [default="*"] (default [*])
-      --image-gc-high-threshold value                  The percent of disk usage after which image garbage collection is always run. Default: 90% (default 90)
+      --hostname-override string                                If non-empty, will use this string as identification instead of the actual hostname.
-      --image-gc-low-threshold value                   The percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. Default: 80% (default 80)
+      --http-check-frequency duration                           Duration between checking http for new data (default 20s)
-      --image-service-endpoint string                  The unix socket endpoint of remote image service. If not specified, it will be the same with container-runtime-endpoint by default. This is an experimental feature. Intended for testing only.
+      --image-gc-high-threshold int32                           The percent of disk usage after which image garbage collection is always run. Default: 90% (default 90)
-      --iptables-drop-bit value                        The bit of the fwmark space to mark packets for dropping. Must be within the range [0, 31]. (default 15)
+      --image-gc-low-threshold int32                            The percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. Default: 80% (default 80)
-      --iptables-masquerade-bit value                  The bit of the fwmark space to mark packets for SNAT. Must be within the range [0, 31]. Please match this parameter with corresponding parameter in kube-proxy. (default 14)
+      --image-service-endpoint string                           [Experimental] The unix socket endpoint of remote image service. If not specified, it will be the same with container-runtime-endpoint by default. The endpoint is used only when CRI integration is enabled (--experimental-cri)
-      --kube-api-burst value                           Burst to use while talking with kubernetes apiserver (default 10)
+      --iptables-drop-bit int32                                 The bit of the fwmark space to mark packets for dropping. Must be within the range [0, 31]. (default 15)
-      --kube-api-content-type string                   Content type of requests sent to apiserver. (default "application/vnd.kubernetes.protobuf")
+      --iptables-masquerade-bit int32                           The bit of the fwmark space to mark packets for SNAT. Must be within the range [0, 31]. Please match this parameter with corresponding parameter in kube-proxy. (default 14)
-      --kube-api-qps value                             QPS to use while talking with kubernetes apiserver (default 5)
+      --kube-api-burst int32                                    Burst to use while talking with Kubernetes apiserver (default 10)
-      --kube-reserved value                            A set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs that describe resources reserved for kubernetes system components. Currently only cpu and memory are supported. See http://releases.k8s.io/release-1.4/docs/user-guide/compute-resources.md for more detail. [default=none]
+      --kube-api-content-type string                            Content type of requests sent to apiserver. (default "application/vnd.kubernetes.protobuf")
-      --kubeconfig value                               Path to a kubeconfig file, specifying how to connect to the API server. --api-servers will be used for the location unless --require-kubeconfig is set. (default "/var/lib/kubelet/kubeconfig")
+      --kube-api-qps int32                                      QPS to use while talking with Kubernetes apiserver (default 5)
-      --kubelet-cgroups string                         Optional absolute name of cgroups to create and run the Kubelet in.
+      --kube-reserved mapStringString                           A set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs that describe resources reserved for kubernetes system components. Currently only cpu and memory are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. [default=none]
-      --lock-file string                               <Warning: Alpha feature> The path to file for kubelet to use as a lock file.
+      --kubeconfig string                                       Path to a kubeconfig file, specifying how to connect to the API server. --api-servers will be used for the location unless --require-kubeconfig is set. (default "/var/lib/kubelet/kubeconfig")
-      --low-diskspace-threshold-mb value               The absolute free disk space, in MB, to maintain. When disk space falls below this threshold, new pods would be rejected. Default: 256 (default 256)
+      --kubelet-cgroups string                                  Optional absolute name of cgroups to create and run the Kubelet in.
-      --make-iptables-util-chains                      If true, kubelet will ensure iptables utility rules are present on host. (default true)
+      --lock-file string                                        <Warning: Alpha feature> The path to file for kubelet to use as a lock file.
-      --manifest-url string                            URL for accessing the container manifest
+      --low-diskspace-threshold-mb int32                        The absolute free disk space, in MB, to maintain. When disk space falls below this threshold, new pods would be rejected. Default: 256 (default 256)
-      --manifest-url-header string                     HTTP header to use when accessing the manifest URL, with the key separated from the value with a ':', as in 'key:value'
+      --make-iptables-util-chains                               If true, kubelet will ensure iptables utility rules are present on host. (default true)
-      --master-service-namespace string                The namespace from which the kubernetes master services should be injected into pods (default "default")
+      --manifest-url string                                     URL for accessing the container manifest
-      --max-open-files int                             Number of files that can be opened by Kubelet process. [default=1000000] (default 1000000)
+      --manifest-url-header string                              HTTP header to use when accessing the manifest URL, with the key separated from the value with a ':', as in 'key:value'
-      --max-pods value                                 Number of Pods that can run on this Kubelet. (default 110)
+      --master-service-namespace string                         The namespace from which the Kubernetes master services should be injected into pods (default "default")
-      --minimum-image-ttl-duration duration            Minimum age for an unused image before it is garbage collected.  Examples: '300ms', '10s' or '2h45m'. Default: '2m' (default 2m0s)
+      --max-open-files int                                      Number of files that can be opened by Kubelet process. [default=1000000] (default 1000000)
-      --network-plugin string                          <Warning: Alpha feature> The name of the network plugin to be invoked for various events in kubelet/pod lifecycle
+      --max-pods int32                                          Number of Pods that can run on this Kubelet. (default 110)
-      --network-plugin-dir string                      <Warning: Alpha feature> The full path of the directory in which to search for network plugins (default "/usr/libexec/kubernetes/kubelet-plugins/net/exec/")
+      --minimum-image-ttl-duration duration                     Minimum age for an unused image before it is garbage collected.  Examples: '300ms', '10s' or '2h45m'. Default: '2m' (default 2m0s)
-      --network-plugin-mtu value                       <Warning: Alpha feature> The MTU to be passed to the network plugin, to override the default. Set to 0 to use the default 1460 MTU.
+      --network-plugin string                                   <Warning: Alpha feature> The name of the network plugin to be invoked for various events in kubelet/pod lifecycle
-      --node-ip string                                 IP address of the node. If set, kubelet will use this IP address for the node
+      --network-plugin-dir string                               <Warning: Alpha feature> The full path of the directory in which to search for network plugins or CNI config
-      --node-labels value                              <Warning: Alpha feature> Labels to add when registering the node in the cluster.  Labels must be key=value pairs separated by ','.
+      --network-plugin-mtu int32                                <Warning: Alpha feature> The MTU to be passed to the network plugin, to override the default. Set to 0 to use the default 1460 MTU.
-      --node-status-update-frequency duration          Specifies how often kubelet posts node status to master. Note: be cautious when changing the constant, it must work with nodeMonitorGracePeriod in nodecontroller. Default: 10s (default 10s)
+      --node-ip string                                          IP address of the node. If set, kubelet will use this IP address for the node
-      --non-masquerade-cidr string                     Traffic to IPs outside this range will use IP masquerade. (default "10.0.0.0/8")
+      --node-labels mapStringString                             <Warning: Alpha feature> Labels to add when registering the node in the cluster.  Labels must be key=value pairs separated by ','.
-      --oom-score-adj value                            The oom-score-adj value for kubelet process. Values must be within the range [-1000, 1000] (default -999)
+      --node-status-update-frequency duration                   Specifies how often kubelet posts node status to master. Note: be cautious when changing the constant, it must work with nodeMonitorGracePeriod in nodecontroller. Default: 10s (default 10s)
-      --outofdisk-transition-frequency duration        Duration for which the kubelet has to wait before transitioning out of out-of-disk node condition status. Default: 5m0s (default 5m0s)
+      --non-masquerade-cidr string                              Traffic to IPs outside this range will use IP masquerade. (default "10.0.0.0/8")
-      --pod-cidr string                                The CIDR to use for pod IP addresses, only used in standalone mode.  In cluster mode, this is obtained from the master.
+      --oom-score-adj int32                                     The oom-score-adj value for kubelet process. Values must be within the range [-1000, 1000] (default -999)
-      --pod-infra-container-image string               The image whose network/ipc namespaces containers in each pod will use. (default "gcr.io/google_containers/pause-amd64:3.0")
+      --outofdisk-transition-frequency duration                 Duration for which the kubelet has to wait before transitioning out of out-of-disk node condition status. Default: 5m0s (default 5m0s)
-      --pod-manifest-path string                       Path to to the directory containing pod manifest files to run, or the path to a single pod manifest file.
+      --pod-cidr string                                         The CIDR to use for pod IP addresses, only used in standalone mode.  In cluster mode, this is obtained from the master.
-      --pods-per-core value                            Number of Pods per core that can run on this Kubelet. The total number of Pods on this Kubelet cannot exceed max-pods, so max-pods will be used if this calculation results in a larger number of Pods allowed on the Kubelet. A value of 0 disables this limit.
+      --pod-infra-container-image string                        The image whose network/ipc namespaces containers in each pod will use. (default "gcr.io/google_containers/pause-amd64:3.0")
-      --port value                                     The port for the Kubelet to serve on. (default 10250)
+      --pod-manifest-path string                                Path to to the directory containing pod manifest files to run, or the path to a single pod manifest file.
-      --protect-kernel-defaults                        Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than kubelet defaults.
+      --pods-per-core int32                                     Number of Pods per core that can run on this Kubelet. The total number of Pods on this Kubelet cannot exceed max-pods, so max-pods will be used if this calculation results in a larger number of Pods allowed on the Kubelet. A value of 0 disables this limit.
-      --read-only-port value                           The read-only port for the Kubelet to serve on with no authentication/authorization (set to 0 to disable) (default 10255)
+      --port int32                                              The port for the Kubelet to serve on. (default 10250)
-      --really-crash-for-testing                       If true, when panics occur crash. Intended for testing.
+      --protect-kernel-defaults                                 Default kubelet behaviour for kernel tuning. If set, kubelet errors if any of kernel tunables is different than kubelet defaults.
-      --reconcile-cidr                                 Reconcile node CIDR with the CIDR specified by the API server. No-op if register-node or configure-cbr0 is false. [default=true] (default true)
+      --read-only-port int32                                    The read-only port for the Kubelet to serve on with no authentication/authorization (set to 0 to disable) (default 10255)
-      --register-node                                  Register the node with the apiserver (defaults to true if --api-servers is set) (default true)
+      --really-crash-for-testing                                If true, when panics occur crash. Intended for testing.
-      --register-schedulable                           Register the node as schedulable. No-op if register-node is false. [default=true] (default true)
+      --register-node                                           Register the node with the apiserver (defaults to true if --api-servers is set) (default true)
-      --registry-burst value                           Maximum size of a bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding registry-qps.  Only used if --registry-qps > 0 (default 10)
+      --register-schedulable                                    Register the node as schedulable. Won't have any effect if register-node is false. [default=true] (default true)
-      --registry-qps value                             If > 0, limit registry pull QPS to this value.  If 0, unlimited. [default=5.0] (default 5)
+      --registry-burst int32                                    Maximum size of a bursty pulls, temporarily allows pulls to burst to this number, while still not exceeding registry-qps.  Only used if --registry-qps > 0 (default 10)
-      --require-kubeconfig                             If true the Kubelet will exit if there are configuration errors, and will ignore the value of --api-servers in favor of the server defined in the kubeconfig file.
+      --registry-qps int32                                      If > 0, limit registry pull QPS to this value.  If 0, unlimited. [default=5.0] (default 5)
-      --resolv-conf string                             Resolver configuration file used as the basis for the container DNS resolution configuration. (default "/etc/resolv.conf")
+      --require-kubeconfig                                      If true the Kubelet will exit if there are configuration errors, and will ignore the value of --api-servers in favor of the server defined in the kubeconfig file.
-      --rkt-api-endpoint string                        The endpoint of the rkt API service to communicate with. Only used if --container-runtime='rkt'. (default "localhost:15441")
+      --resolv-conf string                                      Resolver configuration file used as the basis for the container DNS resolution configuration. (default "/etc/resolv.conf")
-      --rkt-path string                                Path of rkt binary. Leave empty to use the first rkt in $PATH.  Only used if --container-runtime='rkt'.
+      --rkt-api-endpoint string                                 The endpoint of the rkt API service to communicate with. Only used if --container-runtime='rkt'. (default "localhost:15441")
-      --root-dir string                                Directory path for managing kubelet files (volume mounts,etc). (default "/var/lib/kubelet")
+      --rkt-path string                                         Path of rkt binary. Leave empty to use the first rkt in $PATH.  Only used if --container-runtime='rkt'.
-      --runonce                                        If true, exit after spawning pods from local manifests or remote urls. Exclusive with --api-servers, and --enable-server
+      --root-dir string                                         Directory path for managing kubelet files (volume mounts,etc). (default "/var/lib/kubelet")
-      --runtime-cgroups string                         Optional absolute name of cgroups to create and run the runtime in.
+      --runonce                                                 If true, exit after spawning pods from local manifests or remote urls. Exclusive with --api-servers, and --enable-server
-      --runtime-request-timeout duration               Timeout of all runtime requests except long running request - pull, logs, exec and attach. When timeout exceeded, kubelet will cancel the request, throw out an error and retry later. Default: 2m0s (default 2m0s)
+      --runtime-cgroups string                                  Optional absolute name of cgroups to create and run the runtime in.
-      --seccomp-profile-root string                    Directory path for seccomp profiles.
+      --runtime-request-timeout duration                        Timeout of all runtime requests except long running request - pull, logs, exec and attach. When timeout exceeded, kubelet will cancel the request, throw out an error and retry later. Default: 2m0s (default 2m0s)
-      --serialize-image-pulls                          Pull images one at a time. We recommend *not* changing the default value on nodes that run docker daemon with version < 1.9 or an Aufs storage backend. Issue #10959 has more details. [default=true] (default true)
+      --seccomp-profile-root string                             Directory path for seccomp profiles. (default "/var/lib/kubelet/seccomp")
-      --streaming-connection-idle-timeout duration     Maximum time a streaming connection can be idle before the connection is automatically closed. 0 indicates no timeout. Example: '5m' (default 4h0m0s)
+      --serialize-image-pulls                                   Pull images one at a time. We recommend *not* changing the default value on nodes that run docker daemon with version < 1.9 or an Aufs storage backend. Issue #10959 has more details. [default=true] (default true)
-      --sync-frequency duration                        Max period between synchronizing running containers and config (default 1m0s)
+      --streaming-connection-idle-timeout duration              Maximum time a streaming connection can be idle before the connection is automatically closed. 0 indicates no timeout. Example: '5m' (default 4h0m0s)
-      --system-cgroups /                               Optional absolute name of cgroups in which to place all non-kernel processes that are not already inside a cgroup under /. Empty for no container. Rolling back the flag requires a reboot. (Default: "").
+      --sync-frequency duration                                 Max period between synchronizing running containers and config (default 1m0s)
-      --system-reserved value                          A set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs that describe resources reserved for non-kubernetes components. Currently only cpu and memory are supported. See http://releases.k8s.io/release-1.4/docs/user-guide/compute-resources.md for more detail. [default=none]
+      --system-cgroups /                                        Optional absolute name of cgroups in which to place all non-kernel processes that are not already inside a cgroup under /. Empty for no container. Rolling back the flag requires a reboot. (Default: "").
-      --tls-cert-file string                           File containing x509 Certificate for HTTPS.  (CA cert, if any, concatenated after server cert). If --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to the directory passed to --cert-dir.
+      --system-reserved mapStringString                         A set of ResourceName=ResourceQuantity (e.g. cpu=200m,memory=150G) pairs that describe resources reserved for non-kubernetes components. Currently only cpu and memory are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. [default=none]
-      --tls-private-key-file string                    File containing x509 private key matching --tls-cert-file.
+      --tls-cert-file string                                    File containing x509 Certificate for HTTPS.  (CA cert, if any, concatenated after server cert). If --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to the directory passed to --cert-dir.
-      --volume-plugin-dir string                       <Warning: Alpha feature> The full path of the directory in which to search for additional third party volume plugins (default "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/")
+      --tls-private-key-file string                             File containing x509 private key matching --tls-cert-file.
-      --volume-stats-agg-period duration               Specifies interval for kubelet to calculate and cache the volume disk usage for all pods and volumes.  To disable volume calculations, set to 0.  Default: '1m' (default 1m0s)
+      --volume-plugin-dir string                                <Warning: Alpha feature> The full path of the directory in which to search for additional third party volume plugins (default "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/")
+      --volume-stats-agg-period duration                        Specifies interval for kubelet to calculate and cache the volume disk usage for all pods and volumes.  To disable volume calculations, set to 0.  Default: '1m' (default 1m0s)
 ```
 
-###### Auto generated by spf13/cobra on 2-Sep-2016
+###### Auto generated by spf13/cobra on 13-Dec-2016
-
-
-
-
 
 
 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->

docs/admin/limitrange/index.md

@@ -2,13 +2,13 @@
 assignees:
 - derekwaynecarr
 - janetkuo
-
+title: Setting Pod CPU and Memory Limits
 ---
 
 By default, pods run with unbounded CPU and memory limits.  This means that any pod in the
 system will be able to consume as much CPU and memory on the node that executes the pod.
 
-Users may want to impose restrictions on the amount of resource a single pod in the system may consume
+Users may want to impose restrictions on the amount of resources a single pod in the system may consume
 for a variety of reasons.
 
 For example:
@@ -124,7 +124,7 @@ nginx-2040093540-s8vzu   1/1       Running   0          11s
 
 Let's print this Pod with yaml output format (using `-o yaml` flag), and then `grep` the `resources` field. Note that your pod name will be different. 
 
-``` shell
+```shell
 $ kubectl get pods nginx-2040093540-s8vzu --namespace=limit-example -o yaml | grep resources -C 8
   resourceVersion: "57"
   selfLink: /api/v1/namespaces/limit-example/pods/nginx-2040093540-ivimu
@@ -184,7 +184,7 @@ Note that this pod specifies explicit resource *limits* and *requests* so it did
 default values.
 
 Note: The *limits* for CPU resource are enforced in the default Kubernetes setup on the physical node
-that runs the container unless the administrator deploys the kubelet with the folllowing flag:
+that runs the container unless the administrator deploys the kubelet with the following flag:
 
 ```shell
 $ kubelet --help

docs/admin/master-node-communication.md

@@ -2,13 +2,14 @@
 assignees:
 - dchen1107
 - roberthbailey
-
+- liggitt
+title: Master-Node communication
 ---
 
 * TOC
 {:toc}
 
-## Summary
+## Overview
 
 This document catalogs the communication paths between the master (really the
 apiserver) and the Kubernetes cluster. The intent is to allow users to
@@ -22,14 +23,21 @@ All communication paths from the cluster to the master terminate at the
 apiserver (none of the other master components are designed to expose remote
 services). In a typical deployment, the apiserver is configured to listen for
 remote connections on a secure HTTPS port (443) with one or more forms of
-client [authentication](/docs/admin/authentication/) enabled.
+client [authentication](/docs/admin/authentication/) enabled. One or more forms
+of [authorization](/docs/admin/authorization/) should be enabled, especially
+if [anonymous requests](/docs/admin/authentication/#anonymous-requests) or 
+[service account tokens](/docs/admin/authentication/#service-account-tokens) 
+are allowed.
 
 Nodes should be provisioned with the public root certificate for the cluster
 such that they can connect securely to the apiserver along with valid client
 credentials. For example, on a default GCE deployment, the client credentials
-provided to the kubelet are in the form of a client certificate. Pods that
+provided to the kubelet are in the form of a client certificate. See 
-wish to connect to the apiserver can do so securely by leveraging a service
+[kubelet TLS bootstrapping](/docs/admin/kubelet-tls-bootstrapping/) for 
-account so that Kubernetes will automatically inject the public root
+automated provisioning of kubelet client certificates. 
+
+Pods that wish to connect to the apiserver can do so securely by leveraging a 
+service account so that Kubernetes will automatically inject the public root
 certificate and a valid bearer token into the pod when it is instantiated.
 The `kubernetes` service (in all namespaces) is configured with a virtual IP
 address that is redirected (via kube-proxy) to the HTTPS endpoint on the
@@ -54,16 +62,29 @@ cluster. The first is from the apiserver to the kubelet process which runs on
 each node in the cluster. The second is from the apiserver to any node, pod,
 or service through the apiserver's proxy functionality.
 
+### apiserver -> kubelet
+
 The connections from the apiserver to the kubelet are used for fetching logs
 for pods, attaching (through kubectl) to running pods, and using the kubelet's
 port-forwarding functionality. These connections terminate at the kubelet's 
-HTTPS endpoint, which is typically using a self-signed certificate, and
+HTTPS endpoint.
-ignore the certificate presented by the kubelet (although you can override this
+
-behavior by specifying the `--kubelet-certificate-authority`,
+By default, the apiserver does not verify the kubelet's serving certificate,
-`--kubelet-client-certificate`, and `--kubelet-client-key` flags when starting
+which makes the connection subject to man-in-the-middle attacks, and 
-the cluster apiserver). By default, these connections **are not currently safe**
+**unsafe** to run over untrusted and/or public networks.
-to run over untrusted and/or public networks as they are subject to
+
-man-in-the-middle attacks.
+To verify this connection, use the `--kubelet-certificate-authority` flag to 
+provide the apiserver with a root certificates bundle to use to verify the 
+kubelet's serving certificate.
+
+If that is not possible, use [SSH tunneling](/docs/admin/master-node-communication/#ssh-tunnels)
+between the apiserver and kubelet if required to avoid connecting over an 
+untrusted or public network.
+
+Finally, [Kubelet authentication and/or authorization](/docs/admin/kubelet-authentication-authorization/)
+should be enabled to secure the kubelet API. 
+
+### apiserver -> nodes, pods, and services
 
 The connections from the apiserver to a node, pod, or service default to plain
 HTTP connections and are therefore neither authenticated nor encrypted. They
@@ -83,83 +104,3 @@ cluster (connecting to the ssh server listening on port 22) and passes all
 traffic destined for a kubelet, node, pod, or service through the tunnel.
 This tunnel ensures that the traffic is not exposed outside of the private
 GCE network in which the cluster is running.
-
-### Kubelet TLS Bootstrap 
-
-Kubernetes 1.4 introduces an experimental API for requesting certificates from a cluster-level 
-Certificate Authority (CA). The first supported use of this API is the provisioning of TLS client 
-certificates for kubelets. The proposal can be found [here](https://github.com/kubernetes/kubernetes/pull/20439)
-and progress on the feature is being tracked as [feature #43](https://github.com/kubernetes/features/issues/43). 
-
-##### apiserver configuration
-You must provide a token file which specifies at least one "bootstrap token" assigned to a kubelet boostrap-specific group.
-This group will later be used in the controller-manager configuration to scope approvals in the default approval
-controller. As this feature matures, you should ensure tokens are bound to an RBAC policy which limits requests
-using the bootstrap token to only be able to make requests related to certificate provisioning. When RBAC policy
-is in place, scoping the tokens to a group will allow great flexibility (e.g. you could disable a particular
-bootstrap group's access when you are done provisioning the nodes). 
-
-##### Token auth file 
-Tokens are arbitrary but should represent at least 128 bits of entropy derived from a secure random number 
-generator (such as /dev/urandom on most modern systems). There are multiple ways you can generate a token. For example: 
-
-`head -c 16 /dev/urandom | od -An -t x | tr -d ' '` 
-
-will generate tokens that look like `02b50b05283e98dd0fd71db496ef01e8` 
-
-The token file will look like the following example, where the first three values can be anything and the quoted group 
-name should be as depicted: 
-
-```
-02b50b05283e98dd0fd71db496ef01e8,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
-``` 
-
-Add the `--token-auth-file=FILENAME` flag to the apiserver command to enable the token file. 
-See docs at http://kubernetes.io/docs/admin/authentication/#static-token-file for further details.
-
-#### controller-manager configuration
-The API for requesting certificates adds a certificate-issuing control loop to the KCM. This takes the form of a 
-[cfssl](https://blog.cloudflare.com/introducing-cfssl/) local signer using assets on disk. 
-Currently, all certificates issued have one year validity and a default set of key usages. 
-
-##### Signing assets 
-You must provide a Certificate Authority in order to provide the cryptographic materials necessary to issue certificates. 
-This CA should be trusted by the apiserver for authentication with the `--client-ca-file=SOMEFILE` flag. The management
-of the CA is beyond the scope of this document but it is recommended that you generate a dedicated CA for Kubernetes.
-Both certificate and key are assumed to be PEM-encoded. 
-
-The new controller-manager flags are: 
-```
---cluster-signing-cert-file="/etc/path/to/kubernetes/ca/ca.crt" --cluster-signing-key-file="/etc/path/to/kubernetes/ca/ca.key"
-``` 
-
-##### Auto-approval 
-To ease deployment and testing, the alpha version of the certificate request API includes a flag to approve all certificate 
-requests made by users in a certain group. The intended use of this is to whitelist only the group corresponding to the bootstrap
-token in the token file above. Use of this flag circumvents makes the "approval" process described below and is not recommended
-for production use. 
-
-The flag is: 
-```
---insecure-experimental-approve-all-kubelet-csrs-for-group="system:kubelet-bootstrap"
-``` 
-
-#### kubelet configuration 
-To use request a client cert from the certificate request API, the kubelet needs a path to a kubeconfig file that contains the
-bootstrap auth token. If the file specified by `--kubeconfig` does not exist, the bootstrap kubeconfig is used to request a
-client certificate from the API server. On success, a kubeconfig file referencing the generated key and obtained certificate
-is written to the path specified by `--kubeconfig`. The certificate and key file will be stored in the directory pointed 
-by `--cert-dir`.  The new flag is: 
-
-```
---experimental-bootstrap-kubeconfig="/path/to/bootstrap/kubeconfig"
-``` 
-
-#### kubectl approval 
-The signing controller does not immediately sign all certificate requests. Instead, it waits until they have been flagged with an 
-"Approved" status by an appropriately-privileged user. This is intended to eventually be an automated process handled by an external
-approval controller, but for the alpha version of the API it can be done manually by a cluster administrator using kubectl. 
-An administrator can list CSRs with `kubectl get csr`, describe one in detail with `kubectl describe <name>`. There are 
-[currently no direct approve/deny commands](https://github.com/kubernetes/kubernetes/issues/30163) so an approver will need to update
-the Status field directly. A rough example of how to do this in bash which should only be used until the porcelain merges is available
-at https://github.com/gtank/csrctl.

docs/admin/multi-cluster.md

@@ -1,14 +1,14 @@
 ---
 assignees:
 - davidopp
-
+title: Using Multiple Clusters
 ---
 
 You may want to set up multiple Kubernetes clusters, both to
 have clusters in different regions to be nearer to your users, and to tolerate failures and/or invasive maintenance.
 This document describes some of the issues to consider when making a decision about doing so.
 
-If you decide to have multiple clusters, kubernetes provides a way to [federate them](/docs/admin/federation/)
+If you decide to have multiple clusters, Kubernetes provides a way to [federate them](/docs/admin/federation/)
 
 ## Scope of a single cluster
 
@@ -52,7 +52,7 @@ Second, decide how many clusters should be able to be unavailable at the same ti
 the number that can be unavailable `U`.  If you are not sure, then 1 is a fine choice.
 
 If it is allowable for load-balancing to direct traffic to any region in the event of a cluster failure, then
-you need at least the larger of `R` or `U + 1` clusters.  If it is not (e.g you want to ensure low latency for all
+you need at least the larger of `R` or `U + 1` clusters.  If it is not (e.g. you want to ensure low latency for all
 users in the event of a cluster failure), then you need to have `R * (U + 1)` clusters
 (`U + 1` in each of `R` regions).  In any case, try to put each cluster in a different zone.
 

docs/admin/multiple-schedulers.md

@@ -2,7 +2,7 @@
 assignees:
 - davidopp
 - madhusudancs
-
+title: Configuring Multiple Schedulers
 ---
 
 Kubernetes ships with a default scheduler that is described [here](/docs/admin/kube-scheduler/).

docs/admin/multiple-zones.md

@@ -3,7 +3,7 @@ assignees:
 - jlowdermilk
 - justinsb
 - quinton-hoole
-
+title: Running in Multiple Zones
 ---
 
 ## Introduction

docs/admin/namespaces/index.md

@@ -2,7 +2,7 @@
 assignees:
 - derekwaynecarr
 - janetkuo
-
+title: Sharing a Cluster with Namespaces
 ---
 
 A Namespace is a mechanism to partition resources created by users into

docs/admin/namespaces/walkthrough.md

@@ -2,7 +2,7 @@
 assignees:
 - derekwaynecarr
 - janetkuo
-
+title: Namespaces Walkthrough
 ---
 
 Kubernetes _namespaces_ help different projects, teams, or customers to share a Kubernetes cluster.
@@ -151,7 +151,7 @@ Let's create some content.
 $ kubectl run snowflake --image=kubernetes/serve_hostname --replicas=2
 ```
 We have just created a deployment whose replica size is 2 that is running the pod called snowflake with a basic container that just serves the hostname. 
-Note that `kubectl run` creates deployments only on kubernetes cluster >= v1.2. If you are running older versions, it creates replication controllers instead.
+Note that `kubectl run` creates deployments only on Kubernetes cluster >= v1.2. If you are running older versions, it creates replication controllers instead.
 If you want to obtain the old behavior, use `--generator=run/v1` to create replication controllers. See [`kubectl run`](/docs/user-guide/kubectl/kubectl_run/) for more details. 
 
 ```shell

docs/admin/network-plugins.md

@@ -3,7 +3,7 @@ assignees:
 - dcbw
 - freehan
 - thockin
-
+title: Network Plugins
 ---
 
 * TOC
@@ -26,27 +26,35 @@ The kubelet has a single default network plugin, and a default network common to
 
 ## Network Plugin Requirements
 
-Besides providing the [`NetworkPlugin` interface](https://github.com/kubernetes/kubernetes/tree/{{page.version}}.0/pkg/kubelet/network/plugins.go) to configure and clean up pod networking, the plugin may also need specific support for kube-proxy.  The iptables proxy obviously depends on iptables, and the plugin may need to ensure that container traffic is made available to iptables.  For example, if the plugin connects containers to a Linux bridge, the plugin must set the `net/bridge/bridge-nf-call-iptables` sysctl to `1` to ensure that the iptables proxy functions correctly.  If the plugin does not use a Linux bridge (but instead something like Open vSwitch or some other mechanism) it should ensure container traffic is appropriately routed for the proxy.
+Besides providing the [`NetworkPlugin` interface](https://github.com/kubernetes/kubernetes/tree/{{page.version}}/pkg/kubelet/network/plugins.go) to configure and clean up pod networking, the plugin may also need specific support for kube-proxy.  The iptables proxy obviously depends on iptables, and the plugin may need to ensure that container traffic is made available to iptables.  For example, if the plugin connects containers to a Linux bridge, the plugin must set the `net/bridge/bridge-nf-call-iptables` sysctl to `1` to ensure that the iptables proxy functions correctly.  If the plugin does not use a Linux bridge (but instead something like Open vSwitch or some other mechanism) it should ensure container traffic is appropriately routed for the proxy.
 
 By default if no kubelet network plugin is specified, the `noop` plugin is used, which sets `net/bridge/bridge-nf-call-iptables=1` to ensure simple configurations (like docker with a bridge) work correctly with the iptables proxy.
 
 ### Exec
 
-Place plugins in `network-plugin-dir/plugin-name/plugin-name`, i.e if you have a bridge plugin and `network-plugin-dir` is `/usr/lib/kubernetes`, you'd place the bridge plugin executable at `/usr/lib/kubernetes/bridge/bridge`. See [this comment](https://github.com/kubernetes/kubernetes/tree/{{page.version}}.0/pkg/kubelet/network/exec/exec.go) for more details.
+Place plugins in `network-plugin-dir/plugin-name/plugin-name`, i.e. if you have a bridge plugin and `network-plugin-dir` is `/usr/lib/kubernetes`, you'd place the bridge plugin executable at `/usr/lib/kubernetes/bridge/bridge`. See [this comment](https://github.com/kubernetes/kubernetes/tree/{{page.version}}/pkg/kubelet/network/exec/exec.go) for more details.
 
 ### CNI
 
-The CNI plugin is selected by passing Kubelet the `--network-plugin=cni` command-line option.  Kubelet reads the first CNI configuration file from `--network-plugin-dir` and uses the CNI configuration from that file to set up each pod's network.  The CNI configuration file must match the [CNI specification](https://github.com/containernetworking/cni/blob/master/SPEC.md), and any required CNI plugins referenced by the configuration must be present in `/opt/cni/bin`.
+The CNI plugin is selected by passing Kubelet the `--network-plugin=cni` command-line option.  Kubelet reads a file from `--cni-conf-dir` (default `/etc/cni/net.d`) and uses the CNI configuration from that file to set up each pod's network.  The CNI configuration file must match the [CNI specification](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration), and any required CNI plugins referenced by the configuration must be present in `--cni-bin-dir` (default `/opt/cni/bin`).
+
+If there are multiple CNI configuration files in the directory, the first one in lexicographic order of file name is used.
+
+In addition to the CNI plugin specified by the configuration file, Kubernetes requires the standard CNI [`lo`](https://github.com/containernetworking/cni/blob/master/plugins/main/loopback/loopback.go) plugin, at minimum version 0.2.0
+
+Limitation: Due to [#31307](https://github.com/kubernetes/kubernetes/issues/31307), `HostPort` won't work with CNI networking plugin at the moment. That means all `hostPort` attribute in pod would be simply ignored.
 
 ### kubenet
 
-The Linux-only kubenet plugin provides functionality similar to the `--configure-cbr0` kubelet command-line option.  It creates a Linux bridge named `cbr0` and creates a veth pair for each pod with the host end of each pair connected to `cbr0`.  The pod end of the pair is assigned an IP address allocated from a range assigned to the node either through configuration or by the controller-manager.  `cbr0` is assigned an MTU matching the smallest MTU of an enabled normal interface on the host.  The kubenet plugin is currently mutually exclusive with, and will eventually replace, the --configure-cbr0 option.  It is also currently incompatible with the flannel experimental overlay.
+Kubenet is a very basic, simple network plugin, on Linux only.  It does not, of itself, implement more advanced features like cross-node networking or network policy.  It is typically used together with a cloud provider that sets up routing rules for communication between nodes, or in single-node environments.
+
+Kubenet creates a Linux bridge named `cbr0` and creates a veth pair for each pod with the host end of each pair connected to `cbr0`.  The pod end of the pair is assigned an IP address allocated from a range assigned to the node either through configuration or by the controller-manager.  `cbr0` is assigned an MTU matching the smallest MTU of an enabled normal interface on the host.
 
 The plugin requires a few things:
 
-* The standard CNI `bridge` and `host-local` plugins are required. Kubenet will first search for them in `/opt/cni/bin`. Specify `network-plugin-dir` to supply additional search path. The first found match will take effect.
+* The standard CNI `bridge`, `lo` and `host-local` plugins are required, at minimum version 0.2.0. Kubenet will first search for them in `/opt/cni/bin`. Specify `network-plugin-dir` to supply additional search path. The first found match will take effect.
 * Kubelet must be run with the `--network-plugin=kubenet` argument to enable the plugin
-* Kubelet must also be run with the `--reconcile-cidr` argument to ensure the IP subnet assigned to the node by configuration or the controller-manager is propagated to the plugin
+* Kubelet should also be run with the `--non-masquerade-cidr=<clusterCidr>` argumment to ensure traffic to IPs outside this range will use IP masquerade.
 * The node must be assigned an IP subnet through either the `--pod-cidr` kubelet command-line option or the `--allocate-node-cidrs=true --cluster-cidr=<cidr>` controller-manager command-line options.
 
 ### Customizing the MTU (with kubenet)
@@ -66,6 +74,6 @@ This option is provided to the network-plugin; currently **only kubenet supports
 ## Usage Summary
 
 * `--network-plugin=exec` specifies that we use the `exec` plugin, with executables located in `--network-plugin-dir`.
-* `--network-plugin=cni` specifies that we use the `cni` network plugin with actual CNI plugin binaries located in `/opt/cni/bin` and CNI plugin configuration located in `network-plugin-dir`, config location defaults to `/etc/cni/net.d`.
+* `--network-plugin=cni` specifies that we use the `cni` network plugin with actual CNI plugin binaries located in `--cni-bin-dir` (default `/opt/cni/bin`) and CNI plugin configuration located in `--cni-conf-dir` (default `/etc/cni/net.d`).
 * `--network-plugin=kubenet` specifies that we use the `kubenet` network plugin with CNI `bridge` and `host-local` plugins placed in `/opt/cni/bin` or `network-plugin-dir`.
 * `--network-plugin-mtu=9001` specifies the MTU to use, currently only used by the `kubenet` network plugin.

docs/admin/networking.md

@@ -2,7 +2,7 @@
 assignees:
 - lavalamp
 - thockin
-
+title: Networking in Kubernetes
 ---
 
 Kubernetes approaches networking somewhat differently than Docker does by
@@ -83,7 +83,7 @@ talk to other VMs in your project.  This is the same basic model.
 Until now this document has talked about containers.  In reality, Kubernetes
 applies IP addresses at the `Pod` scope - containers within a `Pod` share their
 network namespaces - including their IP address.  This means that containers
-within a `Pod` can all reach each other’s ports on `localhost`.  This does imply
+within a `Pod` can all reach each other's ports on `localhost`. This does imply 
 that containers within a `Pod` must coordinate port usage, but this is no
 different than processes in a VM.  We call this the "IP-per-pod" model.  This
 is implemented in Docker as a "pod container" which holds the network namespace
@@ -100,8 +100,19 @@ existence or non-existence of host ports.
 There are a number of ways that this network model can be implemented.  This
 document is not an exhaustive study of the various methods, but hopefully serves
 as an introduction to various technologies and serves as a jumping-off point.
-If some techniques become vastly preferable to others, we might detail them more
+
-here.
+The following networking options are sorted alphabetically - the order does not
+imply any preferential status.
+
+### Contiv
+
+[Contiv](https://github.com/contiv/netplugin) provides configurable networking (native l3 using BGP, overlay using vxlan,  classic l2, or Cisco-SDN/ACI) for various use cases. [Contiv](http://contiv.io) is all open sourced.
+
+### Flannel
+
+[Flannel](https://github.com/coreos/flannel#flannel) is a very simple overlay
+network that satisfies the Kubernetes requirements. Many
+people have reported success with Flannel and Kubernetes.
 
 ### Google Compute Engine (GCE)
 
@@ -158,21 +169,11 @@ Follow the "With Linux Bridge devices" section of [this very nice
 tutorial](http://blog.oddbit.com/2014/08/11/four-ways-to-connect-a-docker/) from
 Lars Kellogg-Stedman.
 
-### Weave Net from Weaveworks
+### Nuage Networks VCS (Virtualized Cloud Services)
 
-[Weave Net](https://www.weave.works/products/weave-net/) is a 
+[Nuage](http://www.nuagenetworks.net) provides a highly scalable policy-based Software-Defined Networking (SDN) platform. Nuage uses the open source Open vSwitch for the data plane along with a feature rich SDN Controller built on open standards.
-resilient and simple to use network for Kubernetes and its hosted applications.  
-Weave Net runs as a [CNI plug-in](https://www.weave.works/docs/net/latest/cni-plugin/)  
-or stand-alone.  In either version, it doesn’t require any configuration or extra code 
-to run, and in both cases, the network provides one IP address per pod - as is standard for Kubernetes.
 
-
+The Nuage platform uses overlays to provide seamless policy-based networking between Kubernetes Pods and non-Kubernetes environments (VMs and bare metal servers). Nuage's policy abstraction model is designed with applications in mind and makes it easy to declare fine-grained policies for applications.The platform's real-time analytics engine enables visibility and security monitoring for Kubernetes applications.
-### Flannel
-
-[Flannel](https://github.com/coreos/flannel#flannel) is a very simple overlay
-network that satisfies the Kubernetes requirements.  It installs in minutes and
-should get you up and running if the above techniques are not working.  Many
-people have reported success with Flannel and Kubernetes.
 
 ### OpenVSwitch
 
@@ -180,10 +181,17 @@ people have reported success with Flannel and Kubernetes.
 complicated way to build an overlay network.  This is endorsed by several of the
 "Big Shops" for networking.
 
+### OVN (Open Virtual Networking)
+
+OVN is an opensource network virtualization solution developed by the
+Open vSwitch community.  It lets one create logical switches, logical routers,
+stateful ACLs, load-balancers etc to build different virtual networking
+topologies.  The project has a specific Kubernetes plugin and documentation
+at [ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes).
 
 ### Project Calico
 
-[Project Calico](https://github.com/projectcalico/calico-containers/blob/master/docs/cni/kubernetes/README.md) is an open source container networking provider and network policy engine.
+[Project Calico](http://docs.projectcalico.org/) is an open source container networking provider and network policy engine.
 
 Calico provides a highly scalable networking and network policy solution for connecting Kubernetes pods based on the same IP networking principles as the internet.  Calico can be deployed without encapsulation or overlays to provide high-performance, high-scale data center networking.  Calico also provides fine-grained, intent based network security policy for Kubernetes pods via its distributed firewall.
 
@@ -191,11 +199,15 @@ Calico can also be run in policy enforcement mode in conjunction with other netw
 
 ### Romana
 
-[Romana](http://romana.io) is an open source software defined networking (SDN) solution that lets you deploy Kubernetes without an overlay network. 
+[Romana](http://romana.io) is an open source network and security automation solution that lets you deploy Kubernetes without an overlay network. Romana supports Kubernetes [Network Policy](/docs/user-guide/networkpolicies/) to provide isolation across network namespaces.
 
-### Contiv
+### Weave Net from Weaveworks
 
-[Contiv](https://github.com/contiv/netplugin) provides configurable networking (native l3 using BGP, overlay using vxlan,  classic l2, or Cisco-SDN/ACI) for various use cases. [Contiv](http://contiv.io) is all open sourced.
+[Weave Net](https://www.weave.works/products/weave-net/) is a 
+resilient and simple to use network for Kubernetes and its hosted applications.  
+Weave Net runs as a [CNI plug-in](https://www.weave.works/docs/net/latest/cni-plugin/)  
+or stand-alone.  In either version, it doesn't require any configuration or extra code
+to run, and in both cases, the network provides one IP address per pod - as is standard for Kubernetes.
 
 ## Other reading
 

docs/admin/node-conformance.md

@@ -1,7 +1,7 @@
 ---
 assignees:
 - Random-Liu
-
+title: Validate Node Setup
 ---
 
 * TOC
@@ -9,54 +9,52 @@ assignees:
 
 ## Node Conformance Test
 
-*Node conformance test* is a test framework validating whether a node meets the
+*Node conformance test* is a containerized test framework that provides a system
-minimum requirement of Kubernetes with a set of system verification and
+verification and functionality test for a node. The test validates whether the
-functionality test. A node which passes the tests is qualified to join a
+node meets the minimum requirements for Kubernetes; a node that passes the test
-Kubernetes cluster.
+is qualified to join a Kubernetes cluster.
 
 ## Limitations
 
-There are following limitations in the current implementation of node
+In Kubernetes version 1.5, node conformance test has the following limitations:
-conformance test. They'll be improved in future version.
 
 * Node conformance test only supports Docker as the container runtime.
-* Node conformance test doesn't validate network related system configurations
-  and functionalities.
 
-## Prerequisite
+## Node Prerequisite
 
-Node conformance test is used to test whether a node is ready to join a
+To run node conformance test, a node must satisfy the same prerequisites as a
-Kubernetes cluster, so the prerequisite is the same with a standard Kubernetes
+standard Kubernetes node. At a minimum, the node should have the following
-node. At least, the node should have properly installed:
+daemons installed:
 
 * Container Runtime (Docker)
 * Kubelet
 
-Node conformance test validates kernel configurations. If the kenrel module
+## Running Node Conformance Test
-`configs` is built as module in your environment, it must be loaded before the
-test. (See [Caveats #3](#caveats) for more information)
 
-## Usage
+To run the node conformance test, perform the following steps:
 
-### Run Node Conformance Test
+1. Point your Kubelet to localhost `--api-servers="http://localhost:8080"`,
+because the test framework starts a local master to test Kubelet. There are some
+other Kubelet flags you may care:
+  * `--pod-cidr`: If you are using `kubenet`, you should specify an arbitrary CIDR
+    to Kubelet, for example `--pod-cidr=10.180.0.0/24`.
+  * `--cloud-provider`: If you are using `--cloud-provider=gce`, you should
+    remove the flag to run the test.
 
-* **Step 1:** Point your Kubelet to localhost `--api-servers="http://localhost:8080"`,
+2. Run the node conformance test with command:
-because the test framework starts a local master to test Kubelet.
-
-* **Step 2:** Run the node conformance test with command:
 
 ```shell
-# $CONFIG_DIR is the pod manifest path of your kubelet.
+# $CONFIG_DIR is the pod manifest path of your Kubelet.
 # $LOG_DIR is the test output path.
 sudo docker run -it --rm --privileged --net=host \
-  -v /:/rootfs:ro -v /var/run:/var/run \
+  -v /:/rootfs -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-  -v $CONFIG_DIR:/etc/manifest -v $LOG_DIR:/var/result \
+  gcr.io/google_containers/node-test:0.2
-  gcr.io/google_containers/node-test-amd64:v0.1
 ```
 
-### Run Node Conformance Test for Other Architectures
+## Running Node Conformance Test for Other Architectures
 
-We also build node conformance test docker images for other architectures:
+Kubernetes also provides node conformance test docker images for other
+architectures:
 
   Arch  |       Image       |
 --------|:-----------------:|
@@ -64,25 +62,16 @@ We also build node conformance test docker images for other architectures:
   arm   |    node-test-arm  |
  arm64  |  node-test-arm64  |
 
-### Run Selected Test
+## Running Selected Test
-
-In fact, Node conformance test is a containerized version of [node e2e
-test](https://github.com/kubernetes/kubernetes/blob/release-1.4/docs/devel/e2e-node-tests.md).
-By default, it runs all conformance test.
-
-Theoretically, you can run any node e2e test if you configure the container and
-mount required volumes properly. But **it is strongly recommended to only run conformance
-test**, because the non-conformance test needs much more complex framework configuration.
 
 To run specific tests, overwrite the environment variable `FOCUS` with the
 regular expression of tests you want to run.
 
 ```shell
 sudo docker run -it --rm --privileged --net=host \
-  -v /:/rootfs:ro -v /var/run:/var/run \
+  -v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-  -v $CONFIG_DIR:/etc/manifest -v $LOG_DIR:/var/result \
   -e FOCUS=MirrorPod \ # Only run MirrorPod test
-  gcr.io/google_containers/node-test-amd64:v0.1
+  gcr.io/google_containers/node-test:0.2
 ```
 
 To skip specific tests, overwrite the environment variable `SKIP` with the
@@ -90,25 +79,22 @@ regular expression of tests you want to skip.
 
 ```shell
 sudo docker run -it --rm --privileged --net=host \
-  -v /:/rootfs:ro -v /var/run:/var/run \
+  -v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
-  -v $CONFIG_DIR:/etc/manifest -v $LOG_DIR:/var/result \
+  -e SKIP=MirrorPod \ # Run all conformance tests but skip MirrorPod test
-  -e SKIP=MirrorPod \ # Run all conformance test and skip MirrorPod test
+  gcr.io/google_containers/node-test:0.2
-  gcr.io/google_containers/node-test-amd64:v0.1
 ```
 
-### Caveats
+Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/devel/e2e-node-tests.md).
+By default, it runs all conformance tests.
 
-* The test will leave some docker images on the node, including the node
+Theoretically, you can run any node e2e test if you configure the container and
-  conformance test image and images of containers used in the functionality
+mount required volumes properly. But **it is strongly recommended to only run conformance
+test**, because it requires much more complex configuration to run non-conformance test.
+
+## Caveats
+
+* The test leaves some docker images on the node, including the node conformance
+  test image and images of containers used in the functionality
   test.
-* The test will leave dead containers on the node, these containers are created
+* The test leaves dead containers on the node. These containers are created
   during the functionality test.
-* Node conformance test validates kernel configuration. However, in some os
-  distro the kernel module `configs` may not be loaded by default, and you will get
-  the error `no config path in [POSSIBLE KERNEL CONFIG FILE PATHS] is
-  available`. In that case please do either of the followings:
-  * Manually load/unload `configs` kernel module: run `sudo modprobe configs` to
-    load the kernel module, and `sudo modprobe -r configs` to unload it after the test.
-  * Mount `modprobe` into the container: Add option `-v /bin/kmod:/bin/kmod
-    -v /sbin/modprobe:/sbin/modprobe -v /lib/modules:/lib/modules` when starting
-    the test container.

docs/admin/node-problem.md

@@ -2,7 +2,7 @@
 assignees:
 - Random-Liu
 - dchen1107
-
+title: Monitoring Node Health
 ---
 
 * TOC
@@ -49,7 +49,7 @@ either `kubectl` or addon pod.
 
 ### Kubectl
 
-This is the recommanded way to start node problem detector outside of GCE. It
+This is the recommended way to start node problem detector outside of GCE. It
 provides more flexible management, such as overwriting the default
 configuration to fit it into your environment or detect
 customized node problems.
@@ -238,7 +238,7 @@ implement a new translator for a new log format.
 
 ## Caveats
 
-It is recommanded to run the node problem detector in your cluster to monitor
+It is recommended to run the node problem detector in your cluster to monitor
 the node health. However, you should be aware that this will introduce extra
 resource overhead on each node. Usually this is fine, because:
 

docs/admin/node.md

@@ -3,7 +3,7 @@ assignees:
 - caesarxuchao
 - dchen1107
 - lavalamp
-
+title: Nodes
 ---
 
 * TOC
@@ -11,44 +11,47 @@ assignees:
 
 ## What is a node?
 
-`Node` is a worker machine in Kubernetes, previously known as `Minion`. Node
+A `node` is a worker machine in Kubernetes, previously known as a `minion`. A node
 may be a VM or physical machine, depending on the cluster. Each node has
-the services necessary to run [Pods](/docs/user-guide/pods) and is managed by the master
+the services necessary to run [pods](/docs/user-guide/pods) and is managed by the master
-components. The services on a node include docker, kubelet and network proxy. See
+components. The services on a node include Docker, kubelet and kube-proxy. See
 [The Kubernetes Node](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/design/architecture.md#the-kubernetes-node) section in the
 architecture design doc for more details.
 
 ## Node Status
 
-Node status describes current status of a node. For now, there are the following
+A node's status contains the following information:
-pieces of information:
 
-### Node Addresses
+* [Addresses](#Addresses)
+* ~~[Phase](#Phase)~~ **deprecated**
+* [Condition](#Condition)
+* [Capacity](#Capacity)
+* [Info](#Info)
+
+Each section is described in detail below.
+
+### Addresses
 
 The usage of these fields varies depending on your cloud provider or bare metal configuration.
 
-* HostName: Generally not used
+* HostName: The hostname as reported by the node's kernel. Can be overridden via the kubelet `--hostname-override` parameter.
+* ExternalIP: Typically the IP address of the node that is externally routable (available from outside the cluster).
+* InternalIP: Typically the IP address of the node that is routable only within the cluster.
 
-* ExternalIP: Generally the IP address of the node that is externally routable (available from outside the cluster)
+### Phase
 
-* InternalIP: Generally the IP address of the node that is routable only within the cluster
+Deprecated: node phase is no longer used.
 
-
+### Condition
-### Node Phase
-
-Deprecated: Node Phase is no longer used
-
-### Node Condition
 
 The `conditions` field describes the status of all `Running` nodes.
 
 | Node Condition | Description |
 |----------------|-------------|
-| `OutOfDisk`    | `True` if insufficient free space on the node for adding new pods, otherwise `False` |
+| `OutOfDisk`    | `True` if there is insufficient free space on the node for adding new pods, otherwise `False` |
-| `Ready`        | `True` if the node is healthy ready to accept pods, `False` if the node is not healthy and is not accepting pods, and `Unknown` if the Node Controller has not heard from the node in the last 40 seconds |
+| `Ready`        | `True` if the node is healthy and ready to accept pods, `False` if the node is not healthy and is not accepting pods, and `Unknown` if the node controller has not heard from the node in the last 40 seconds |
 
-Node condition is represented as a JSON object. For example, the following response describes a healthy node:
+The node condition is represented as a JSON object. For example, the following response describes a healthy node.
-conditions mean the node is in sane state:
 
 ```json
 "conditions": [
@@ -59,28 +62,30 @@ conditions mean the node is in sane state:
 ]
 ```
 
-If the Status of the Ready condition
+If the Status of the Ready condition is "Unknown" or "False" for longer than the `pod-eviction-timeout`, an argument passed to the [kube-controller-manager](docs/admin/kube-controller-manager/), all of the Pods on the node are scheduled for deletion by the Node Controller. The default eviction timeout duration is **five minutes**. In some cases when the node is unreachable, the apiserver is unable to communicate with the kubelet on it. The decision to delete the pods cannot be communicated to the kubelet until it re-establishes communication with the apiserver. In the meantime, the pods which are scheduled for deletion may continue to run on the partitioned node. 
-is Unknown or False for more than five minutes, then all of the Pods on the node are terminated by the Node Controller.
 
-### Node Capacity
+In versions of Kubernetes prior to 1.5, the node controller would [force delete](/docs/user-guide/pods/#force-deletion-of-pods) these unreachable pods from the apiserver. However, in 1.5 and higher, the node controller does not force delete pods until it is confirmed that they have stopped running in the cluster. One can see these pods which may be running on an unreachable node as being in the "Terminating" or "Unknown" states. In cases where Kubernetes cannot deduce from the underlying infrastructure if a node has permanently left a cluster, the cluster administrator may need to delete the node object by hand.  Deleting the node object from Kubernetes causes all the Pod objects running on it to be deleted from the apiserver, freeing up their names.
 
-Describes the resources available on the node: CPUs, memory and the maximum
+### Capacity
+
+Describes the resources available on the node: CPU, memory and the maximum
 number of pods that can be scheduled onto the node.
 
-### Node Info
+### Info
 
-General information about the node, for instance kernel version, Kubernetes version
+General information about the node, such as kernel version, Kubernetes version
-(kubelet version, kube-proxy version), docker version (if used), OS name.
+(kubelet and kube-proxy version), Docker version (if used), OS name.
 The information is gathered by Kubelet from the node.
 
-## Node Management
+## Management
 
-Unlike [Pods](/docs/user-guide/pods) and [Services](/docs/user-guide/services), a Node is not inherently
+Unlike [pods](/docs/user-guide/pods) and [services](/docs/user-guide/services),
-created by Kubernetes: it is either taken from cloud providers like Google Compute Engine,
+a node is not inherently created by Kubernetes: it is created externally by cloud
-or from your pool of physical or virtual machines. What this means is that when
+providers like Google Compute Engine, or exists in your pool of physical or virtual
-Kubernetes creates a node, it is really just creating an object that represents the node in its internal state.
+machines. What this means is that when Kubernetes creates a node, it is really
-After creation, Kubernetes will check whether the node is valid or not.
+just creating an object that represents the node. After creation, Kubernetes
-For example, if you try to create a node from the following content:
+will check whether the node is valid or not. For example, if you try to create
+a node from the following content:
 
 ```json
 {
@@ -95,117 +100,127 @@ For example, if you try to create a node from the following content:
 }
 ```
 
-Kubernetes will create a Node object internally (the representation), and
+Kubernetes will create a node object internally (the representation), and
-validate the node by health checking based on the `metadata.name` field: we
+validate the node by health checking based on the `metadata.name` field (we
-assume `metadata.name` can be resolved. If the node is valid, i.e. all necessary
+assume `metadata.name` can be resolved). If the node is valid, i.e. all necessary
-services are running, it is eligible to run a Pod; otherwise, it will be
+services are running, it is eligible to run a pod; otherwise, it will be
-ignored for any cluster activity, until it becomes valid. Note that Kubernetes
+ignored for any cluster activity until it becomes valid. Note that Kubernetes
-will keep the object for the invalid node unless it is explicitly deleted by the client, and it will keep
+will keep the object for the invalid node unless it is explicitly deleted by
-checking to see if it becomes valid.
+the client, and it will keep checking to see if it becomes valid.
 
-Currently, there are three components that interact with the Kubernetes node interface: Node Controller, Kubelet, and kubectl.
+Currently, there are three components that interact with the Kubernetes node
+interface: node controller, kubelet, and kubectl.
 
 ### Node Controller
 
-Node controller is a component in Kubernetes master which manages Node
+The node controller is a Kubernetes master component which manages various
-objects.
+aspects of nodes.
 
-Node controller has mutliple roles in Node's life. First is assigning a CIDR block to
+The node controller has multiple roles in a node's life. The first is assigning a
-the Node when it is registered (if CIDR assignment is turned on). Second is keeping the
+CIDR block to the node when it is registered (if CIDR assignment is turned on).
-node controller's list of nodes up to date with the cloud provider's list of available
+
-machines. When running in cloud environment whenever a node is unhealthy node controller
+The second is keeping the node controller's internal list of nodes up to date with
-asks cloud provider if the VM for that node is still available. If not, the node
+the cloud provider's list of available machines. When running in a cloud
+environment, whenever a node is unhealthy the node controller asks the cloud
+provider if the VM for that node is still available. If not, the node
 controller deletes the node from its list of nodes.
 
-Third responsibiliy is monitoring Node's health. Node controller is responsible for updating
+The third is monitoring the nodes' health. The node controller is
-the NodeReady condition of NodeStatus to ConditionUnknown when a node becomes unreachable
+responsible for updating the NodeReady condition of NodeStatus to
-(i.e. node controller stops receiving heartbeats e.g. due to the node being down), and then
+ConditionUnknown when a node becomes unreachable (i.e. the node controller stops
-later evicting all the pods from the node (using graceful termination) if the node continues
+receiving heartbeats for some reason, e.g. due to the node being down), and then later evicting
-to be unreachable (the current timeouts are 40s to start reporting ConditionUnknown and 5m
+all the pods from the node (using graceful termination) if the node continues
-after that to start evicting pods). Node controller checks the state of each node every
+to be unreachable. (The default timeouts are 40s to start reporting
-`--node-monitor-period` seconds.
+ConditionUnknown and 5m after that to start evicting pods.) The node controller
+checks the state of each node every `--node-monitor-period` seconds.
 
-In 1.4 release we updated the logic of node controller to better handle cases when a
+In Kubernetes 1.4, we updated the logic of the node controller to better handle
-big number of Nodes have problems with reaching the master machine (e.g. because
+cases when a big number of nodes have problems with reaching the master
-master machine has networking problem). Starting with 1.4 node controller will look at the
+(e.g. because the master has networking problem). Starting with 1.4, the node
-state of all Nodes in the cluster when making a decision about pod eviction.
+controller will look at the state of all nodes in the cluster when making a
+decision about pod eviction.
 
-In most cases, node controller limits the eviction rate to `--node-eviction-rate` (default 0.1)
+In most cases, node controller limits the eviction rate to
-per second, meaning it won't evict pods from more than 1 node per 10 seconds.
+`--node-eviction-rate` (default 0.1) per second, meaning it won't evict pods
+from more than 1 node per 10 seconds.
 
-The node eviction behavior changes when a node in a given availability zone becomes unhealthy,
+The node eviction behavior changes when a node in a given availability zone
-node controller checks what percentage of nodes in the zone are unhealthy (NodeReady condition
+becomes unhealthy. The node controller checks what percentage of nodes in the zone
-is ConditionUnknown or ConditionFalse) at the same time. If the fraction of unhealthy nodes is
+are unhealthy (NodeReady condition is ConditionUnknown or ConditionFalse) at
-at least `--unhealthy-zone-threshold` (default 0.55) then the eviction rate is  reduced: if
+the same time. If the fraction of unhealthy nodes is at least
-the cluster is small (i.e. has less than or equal to `--large-cluster-size-threshold`
+`--unhealthy-zone-threshold` (default 0.55) then the eviction rate is reduced:
-nodes - default 50) then evictions are stopped, otherwise the eviction rate is reduced to
+if the cluster is small (i.e. has less than or equal to
-`--secondary-node-eviction-rate` (default 0.01) per second. The reason these policies are
+`--large-cluster-size-threshold` nodes - default 50) then evictions are
-implemented per availability zone is because one availability zone might become partitioned
+stopped, otherwise the eviction rate is reduced to
-from the master while the others remain connected. If your cluster does not span multiple cloud
+`--secondary-node-eviction-rate` (default 0.01) per second. The reason these
-provider availability zones, then there is only one availability zone, namely the whole cluster.
+policies are implemented per availability zone is because one availability zone
+might become partitioned from the master while the others remain connected. If
+your cluster does not span multiple cloud provider availability zones, then
+there is only one availability zone (the whole cluster).
 
-A key reason for spreading your nodes across availability zones is so that workload can be
+A key reason for spreading your nodes across availability zones is so that the
-shifted to healthy zones when one entire zone goes down. To enable this behavior, if all
+workload can be shifted to healthy zones when one entire zone goes down.
-nodes in a zone are unhealthy then node controller evicts at the normal rate `--node-eviction-rate`.
+Therefore, if all nodes in a zone are unhealthy then node controller evicts at
-The corner case for that is when all zones are completely unhealthy (i.e. there's no healthy node in
+the normal rate `--node-eviction-rate`.  The corner case is when all zones are
-the cluster). In such case node controller assumes that there's some problem with master machine
+completely unhealthy (i.e. there are no healthy nodes in the cluster). In such
-connectivity and stops all evictions until any connectivity is restored.
+case, the node controller assumes that there's some problem with master
+connectivity and stops all evictions until some connectivity is restored.
 
 ### Self-Registration of Nodes
 
-When kubelet flag `--register-node` is true (the default), the kubelet will attempt to
+When the kubelet flag `--register-node` is true (the default), the kubelet will attempt to
 register itself with the API server.  This is the preferred pattern, used by most distros.
 
 For self-registration, the kubelet is started with the following options:
 
-  - `--api-servers=` tells the kubelet the location of the apiserver.
+  - `--api-servers=` - Location of the apiservers.
-  - `--kubeconfig` tells kubelet where to find credentials to authenticate itself to the apiserver.
+  - `--kubeconfig=` - Path to credentials to authenticate itself to the apiserver.
-  - `--cloud-provider=` tells the kubelet how to talk to a cloud provider to read metadata about itself.
+  - `--cloud-provider=` - How to talk to a cloud provider to read metadata about itself.
-  - `--register-node` tells the kubelet to create its own node resource.
+  - `--register-node` - Automatically register with the API server.
 
 Currently, any kubelet is authorized to create/modify any node resource, but in practice it only creates/modifies
-its own.  (In the future, we plan to limit authorization to only allow a kubelet to modify its own Node resource.)
+its own. (In the future, we plan to only allow a kubelet to modify its own node resource.)
 
 #### Manual Node Administration
 
-A cluster administrator can create and modify Node objects.
+A cluster administrator can create and modify node objects.
 
-If the administrator wishes to create node objects manually, set kubelet flag
+If the administrator wishes to create node objects manually, set the kubelet flag
 `--register-node=false`.
 
-The administrator can modify Node resources (regardless of the setting of `--register-node`).
+The administrator can modify node resources (regardless of the setting of `--register-node`).
-Modifications include setting labels on the Node, and marking it unschedulable.
+Modifications include setting labels on the node and marking it unschedulable.
 
 Labels on nodes can be used in conjunction with node selectors on pods to control scheduling,
-e.g. to constrain a Pod to only be eligible to run on a subset of the nodes.
+e.g. to constrain a pod to only be eligible to run on a subset of the nodes.
 
-Making a node unscheduleable will prevent new pods from being scheduled to that
+Marking a node as unschedulable will prevent new pods from being scheduled to that
-node, but will not affect any existing pods on the node.  This is useful as a
+node, but will not affect any existing pods on the node. This is useful as a
-preparatory step before a node reboot, etc.  For example, to mark a node
+preparatory step before a node reboot, etc. For example, to mark a node
 unschedulable, run this command:
 
 ```shell
-kubectl patch nodes $NODENAME -p '{"spec": {"unschedulable": true}}'
+kubectl cordon $NODENAME
 ```
 
 Note that pods which are created by a daemonSet controller bypass the Kubernetes scheduler,
-and do not respect the unschedulable attribute on a node.   The assumption is that daemons belong on
+and do not respect the unschedulable attribute on a node.  The assumption is that daemons belong on
 the machine even if it is being drained of applications in preparation for a reboot.
 
 ### Node capacity
 
-The capacity of the node (number of cpus and amount of memory) is part of the node resource.
+The capacity of the node (number of cpus and amount of memory) is part of the node object.
-Normally, nodes register themselves and report their capacity when creating the node resource.  If
+Normally, nodes register themselves and report their capacity when creating the node object. If
 you are doing [manual node administration](#manual-node-administration), then you need to set node
 capacity when adding a node.
 
 The Kubernetes scheduler ensures that there are enough resources for all the pods on a node.  It
 checks that the sum of the limits of containers on the node is no greater than the node capacity.  It
-includes all containers started by kubelet, but not containers started directly by docker, nor
+includes all containers started by the kubelet, but not containers started directly by Docker nor
 processes not in containers.
 
-If you want to explicitly reserve resources for non-Pod processes, you can create a placeholder
+If you want to explicitly reserve resources for non-pod processes, you can create a placeholder
-pod.  Use the following template:
+pod. Use the following template:
 
 ```yaml
 apiVersion: v1
@@ -229,6 +244,6 @@ on each kubelet where you want to reserve resources.
 
 ## API Object
 
-Node is a top-level resource in the kubernetes REST API. More details about the
+Node is a top-level resource in the Kubernetes REST API. More details about the
 API object can be found at: [Node API
 object](/docs/api-reference/v1/definitions/#_v1_node).

docs/admin/out-of-resource.md

@@ -3,7 +3,7 @@ assignees:
 - derekwaynecarr
 - vishh
 - timstclair
-
+title: Configuring Out Of Resource Handling
 ---
 
 * TOC
@@ -29,7 +29,7 @@ table below.  The value of each signal is described in the description column ba
 summary API.
 
 | Eviction Signal  | Description                                                                     |
-|------------------|---------------------------------------------------------------------------------|
+|----------------------------|-----------------------------------------------------------------------|
 | `memory.available` | `memory.available` := `node.status.capacity[memory]` - `node.stats.memory.workingSet` |
 | `nodefs.available` | `nodefs.available` := `node.stats.fs.available` |
 | `nodefs.inodesFree` | `nodefs.inodesFree` := `node.stats.fs.inodesFree` |
@@ -128,7 +128,7 @@ reflects the node is under pressure.
 The following node conditions are defined that correspond to the specified eviction signal.
 
 | Node Condition | Eviction Signal  | Description                                                      |
-|----------------|------------------|------------------------------------------------------------------|
+|-------------------------|-------------------------------|--------------------------------------------|
 | `MemoryPressure` | `memory.available` | Available memory on the node has satisfied an eviction threshold |
 | `DiskPressure` | `nodefs.available`, `nodefs.inodesFree`, `imagefs.available`, or `imagefs.inodesFree` | Available disk space and inodes on either the node's root filesytem or image filesystem has satisfied an eviction threshold |
 
@@ -270,7 +270,7 @@ the node depends on the [oom_killer](https://lwn.net/Articles/391222/) to respon
 The `kubelet` sets a `oom_score_adj` value for each container based on the quality of service for the pod.
 
 | Quality of Service | oom_score_adj |
-| -----------------  | ------------- |
+|----------------------------|-----------------------------------------------------------------------|
 | `Guaranteed` | -998 |
 | `BestEffort` | 1000 |
 | `Burstable` | min(max(2, 1000 - (1000 * memoryRequestBytes) / machineMemoryCapacityBytes), 999) |
@@ -330,7 +330,7 @@ for eviction. Instead `DaemonSet` should ideally launch `Guaranteed` pods.
 `kubelet` has been freeing up disk space on demand to keep the node stable.
 
 As disk based eviction matures, the following `kubelet` flags will be marked for deprecation
-in favor of the simpler configuation supported around eviction.
+in favor of the simpler configuration supported around eviction.
 
 | Existing Flag | New Flag |
 | ------------- | -------- |
@@ -349,7 +349,7 @@ in favor of the simpler configuation supported around eviction.
 The `kubelet` currently polls `cAdvisor` to collect memory usage stats at a regular interval.  If memory usage
 increases within that window rapidly, the `kubelet` may not observe `MemoryPressure` fast enough, and the `OOMKiller`
 will still be invoked.  We intend to integrate with the `memcg` notification API in a future release to reduce this
-latency, and instead have the kernel tell us when a threshold has been crossed immmediately.
+latency, and instead have the kernel tell us when a threshold has been crossed immediately.
 
 If you are not trying to achieve extreme utilization, but a sensible measure of overcommit, a viable workaround for
 this issue is to set eviction thresholds at approximately 75% capacity.  This increases the ability of this feature

docs/admin/ovs-networking.md

@@ -2,7 +2,7 @@
 assignees:
 - lavalamp
 - thockin
-
+title: Kubernetes OpenVSwitch GRE/VxLAN networking
 ---
 
 This document describes how OpenVSwitch is used to setup networking between pods across nodes.

docs/admin/rescheduler.md

@@ -30,29 +30,30 @@ given the pods that are already running in the cluster
 the rescheduler tries to free up space for the add-on by evicting some pods; then the scheduler will schedule the add-on pod.
 
 To avoid situation when another pod is scheduled into the space prepared for the critical add-on,
-the chosen node gets a temporary taint “CriticalAddonsOnly” before the eviction(s)
+the chosen node gets a temporary taint "CriticalAddonsOnly" before the eviction(s)
 (see [more details](https://github.com/kubernetes/kubernetes/blob/master/docs/design/taint-toleration-dedicated.md)).
 Each critical add-on has to tolerate it,
 the other pods shouldn't tolerate the taint. The tain is removed once the add-on is successfully scheduled.
 
 *Warning:* currently there is no guarantee which node is chosen and which pods are being killed
-in order to schedule crical pod, so if rescheduler is enabled you pods might be occasionally
+in order to schedule critical pods, so if rescheduler is enabled you pods might be occasionally
 killed for this purpose.
 
 ## Config
 
 Rescheduler doesn't have any user facing configuration (component config) or API.
 It's enabled by default. It can be disabled:
+
 * during cluster setup by setting `ENABLE_RESCHEDULER` flag to `false`
 * on running cluster by deleting its manifest from master node
 (default path `/etc/kubernetes/manifests/rescheduler.manifest`)
 
 ### Marking add-on as critical
 
-To be critical an add-on has to run in `kube-system` namespace (cofigurable via flag)
+To be critical an add-on has to run in `kube-system` namespace (configurable via flag)
 and have the following annotations specified:
+
 * `scheduler.alpha.kubernetes.io/critical-pod` set to empty string
 * `scheduler.alpha.kubernetes.io/tolerations` set to `[{"key":"CriticalAddonsOnly", "operator":"Exists"}]`
 
 The first one marks a pod a critical. The second one is required by Rescheduler algorithm.
-

docs/admin/resourcequota/index.md

@@ -1,7 +1,7 @@
 ---
 assignees:
 - derekwaynecarr
-
+title: Resource Quotas
 ---
 
 When several users or teams share a cluster with a fixed number of nodes,
@@ -52,20 +52,37 @@ Resource Quota is enforced in a particular namespace when there is a
 
 ## Compute Resource Quota
 
-You can limit the total sum of [compute resources](/docs/user-guide/compute-resources) and [storage resources](/docs/user-guide/persistent-volumes)
+You can limit the total sum of [compute resources](/docs/user-guide/compute-resources) that can be requested in a given namespace.
-that can be requested in a given namespace.
  
 The following resource types are supported:
 
 | Resource Name | Description |
-| ------------ | ----------- |
+| --------------------- | ----------------------------------------------------------- |
 | `cpu` | Across all pods in a non-terminal state, the sum of CPU requests cannot exceed this value. |
 | `limits.cpu` | Across all pods in a non-terminal state, the sum of CPU limits cannot exceed this value. |
 | `limits.memory` | Across all pods in a non-terminal state, the sum of memory limits cannot exceed this value. |
 | `memory` | Across all pods in a non-terminal state, the sum of memory requests cannot exceed this value. |
 | `requests.cpu` | Across all pods in a non-terminal state, the sum of CPU requests cannot exceed this value. |
 | `requests.memory` | Across all pods in a non-terminal state, the sum of memory requests cannot exceed this value. |
+
+## Storage Resource Quota
+
+You can limit the total sum of [storage resources](/docs/user-guide/persistent-volumes) that can be requested in a given namespace. 
+
+In addition, you can limit consumption of storage resources based on associated storage-class.
+
+| Resource Name | Description |
+| --------------------- | ----------------------------------------------------------- |
 | `requests.storage` | Across all persistent volume claims, the sum of storage requests cannot exceed this value. |
+| `persistentvolumeclaims` | The total number of [persistent volume claims](/docs/user-guide/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace. |
+| `<storage-class-name>.storageclass.storage.k8s.io/requests.storage` | Across all persistent volume claims associated with the storage-class-name, the sum of storage requests cannot exceed this value. |
+| `<storage-class-name>.storageclass.storage.k8s.io/persistentvolumeclaims` | Across all persistent volume claims associated with the storage-class-name, the total number of [persistent volume claims](/docs/user-guide/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace. |
+
+For example, if an operator wants to quota storage with `gold` storage class separate from `bronze` storage class, the operator can
+define a quota as follows:
+
+* `gold.storageclass.storage.k8s.io/requests.storage: 500Gi`
+* `bronze.storageclass.storage.k8s.io/requests.storage: 100Gi`
 
 ## Object Count Quota
 
@@ -73,7 +90,7 @@ The number of objects of a given type can be restricted.  The following types
 are supported:
 
 | Resource Name | Description |
-| ------------ | ----------- |
+| ------------------------------- | ------------------------------------------------- |
 | `configmaps` | The total number of config maps that can exist in the namespace. |
 | `persistentvolumeclaims` | The total number of [persistent volume claims](/docs/user-guide/persistent-volumes/#persistentvolumeclaims) that can exist in the namespace. |
 | `pods` | The total number of pods in a non-terminal state that can exist in the namespace.  A pod is in a terminal state if `status.phase in (Failed, Succeeded)` is true.  |
@@ -125,7 +142,7 @@ The quota can be configured to quota either value.
 
 If the quota has a value specified for `requests.cpu` or `requests.memory`, then it requires that every incoming
 container makes an explicit request for those resources.  If the quota has a value specified for `limits.cpu` or `limits.memory`,
-then it requires that every incoming container specifies an explict limit for those resources.
+then it requires that every incoming container specifies an explicit limit for those resources.
 
 ## Viewing and Setting Quotas
 

docs/admin/resourcequota/walkthrough.md

@@ -2,7 +2,7 @@
 assignees:
 - derekwaynecarr
 - janetkuo
-
+title: Applying Resource Quotas and Limits
 ---
 
 This example demonstrates a typical setup to control for resource usage in a namespace.
@@ -232,7 +232,7 @@ services.loadbalancers 0      2
 services.nodeports     0      0
 ```
 
-As you can see, the pod that was created is consuming explict amounts of compute resources, and the usage is being
+As you can see, the pod that was created is consuming explicit amounts of compute resources, and the usage is being
 tracked by Kubernetes properly.
 
 ## Step 5: Advanced quota scopes

docs/admin/salt.md

@@ -2,7 +2,7 @@
 assignees:
 - davidopp
 - lavalamp
-
+title: Configuring Kubernetes with Salt
 ---
 
 The Kubernetes cluster can be configured using Salt.
@@ -64,7 +64,7 @@ Each hosting environment has a slightly different grains.conf file that is used
 The following enumerates the set of defined key/value pairs that are supported today.  If you add new ones, please make sure to update this list.
 
 Key | Value
-------------- | -------------
+-----------------------------------|----------------------------------------------------------------
 `api_servers` | (Optional) The IP address / host name where a kubelet can get read-only access to kube-apiserver
 `cbr-cidr` | (Optional) The minion IP address range used for the docker container bridge.
 `cloud` | (Optional) Which IaaS platform is used to host Kubernetes, *gce*, *azure*, *aws*, *vagrant*

docs/admin/service-accounts-admin.md

@@ -4,7 +4,7 @@ assignees:
 - davidopp
 - lavalamp
 - liggitt
-
+title: Managing Service Accounts
 ---
 
 *This is a Cluster Administrator guide to service accounts.  It assumes knowledge of

docs/admin/static-pods.md

@@ -1,7 +1,7 @@
 ---
 assignees:
 - jsafrane
-
+title: Static Pods
 ---
 
 **If you are running clustered Kubernetes and are using static pods to run a pod on every node, you should probably be using a [DaemonSet](/docs/admin/daemons/)!**
@@ -16,7 +16,7 @@ Static pod can be created in two ways: either by using configuration file(s) or
 
 ### Configuration files
 
-The configuration files are just standard pod definition in json or yaml format in specific directory. Use `kubelet --config=<the directory>` to start kubelet daemon, which periodically scans the directory and creates/deletes static pods as yaml/json files appear/disappear there.
+The configuration files are just standard pod definition in json or yaml format in specific directory. Use `kubelet --pod-manifest-path=<the directory>` to start kubelet daemon, which periodically scans the directory and creates/deletes static pods as yaml/json files appear/disappear there.
 
 For example, this is how to start a simple web server as a static pod:
 
@@ -48,10 +48,10 @@ For example, this is how to start a simple web server as a static pod:
     EOF
     ```
 
-2. Configure your kubelet daemon on the node to use this directory by running it with `--config=/etc/kubelet.d/` argument.  On Fedora edit `/etc/kubernetes/kubelet` to include this line:
+2. Configure your kubelet daemon on the node to use this directory by running it with `--pod-manifest-path=/etc/kubelet.d/` argument.  On Fedora edit `/etc/kubernetes/kubelet` to include this line:
 
     ```conf
-    KUBELET_ARGS="--cluster-dns=10.254.0.10 --cluster-domain=kube.local --config=/etc/kubelet.d/"
+    KUBELET_ARGS="--cluster-dns=10.254.0.10 --cluster-domain=kube.local --pod-manifest-path=/etc/kubelet.d/"
     ```
 
     Instructions for other distributions or Kubernetes installations may vary.
@@ -64,11 +64,11 @@ For example, this is how to start a simple web server as a static pod:
 
 ## Pods created via HTTP
 
-Kubelet periodically downloads a file specified by `--manifest-url=<URL>` argument and interprets it as a json/yaml file with a pod definition. It works the same as `--config=<directory>`, i.e. it's reloaded every now and then and changes are applied to running static pods (see below).
+Kubelet periodically downloads a file specified by `--manifest-url=<URL>` argument and interprets it as a json/yaml file with a pod definition. It works the same as `--pod-manifest-path=<directory>`, i.e. it's reloaded every now and then and changes are applied to running static pods (see below).
 
 ## Behavior of static pods
 
-When kubelet starts, it automatically starts all pods defined in directory specified in `--config=` or `--manifest-url=` arguments, i.e. our static-web.  (It may take some time to pull nginx image, be patient…):
+When kubelet starts, it automatically starts all pods defined in directory specified in `--pod-manifest-path=` or `--manifest-url=` arguments, i.e. our static-web.  (It may take some time to pull nginx image, be patient…):
 
 ```shell
 [joe@my-node1 ~] $ docker ps
@@ -88,7 +88,7 @@ static-web-my-node1     172.17.0.3                              my-node1/192.168
 
 Labels from the static pod are propagated into the mirror-pod and can be used as usual for filtering.
 
-Notice we cannot delete the pod with the API server (e.g. via [`kubectl`](/docs/user-guide/kubectl/kubectl/) command), kubelet simply won't remove it.
+Notice we cannot delete the pod with the API server (e.g. via [`kubectl`](/docs/user-guide/kubectl/) command), kubelet simply won't remove it.
 
 ```shell
 [joe@my-master ~] $ kubectl delete pod static-web-my-node1

docs/admin/sysctls.md

@@ -9,7 +9,7 @@ assignees:
 
 This document describes how sysctls are used within a Kubernetes cluster.
 
-## What is a _Sysctl_?
+## What is a Sysctl?
 
 In Linux, the sysctl interface allows an administrator to modify kernel
 parameters at runtime. Parameters are available via the `/proc/sys/` virtual