Merge branch 'master' of git://github.com/kubernetes/website into release-1.12

* 'master' of git://github.com/kubernetes/website: (222 commits)
  Add temporary owners for 1.13 release (#11453)
  fix Minikube 404 error. (#11461)
  Resolve conflicts against dev-1.13 for /ko contents (#11439)
  replace `run` with `create deployment` (#11392)
  Updated list all pods with -o wide comment (#11394)
  fix broken link for KubeletConfiguration (#11423)
  Update on pod-priority-preemption.md (#11418)
  Add guidelines for working with localized content (#11415)
  Update what-is-kubernetes.md (#11399)
  Remove redundant close tags and little bit formatting (#11389)
  Add SysEleven MetaKube as hosted solution (#11393)
  Add rui to sig-docs-zh team (#11391)
  fix Improper translation (#11384)
  Add pigletfly(WangBing) as a sig-docs-zh-reviewer (#11370)
  update link to CloudProvider Interface (#11228)
  Fix the "my-scheduler-as-kube-scheduler" ClusterRoleBinding. (#11112)
  fix non-existing "CloudProvider Interface" link (#10953)
  Updated ingress.md (#11213)
  Further updates to TLS Bootstrapping (#11258)
  Updated 'exec' description (#11365)
  ...

content/en/docs/concepts/policy/_index.md

@@ -1,5 +1,5 @@
 ---
 title: "Policies"
-weight: 160
+weight: 90
 ---
 

content/en/docs/concepts/policy/pod-security-policy.md

@@ -37,7 +37,7 @@ administrator to control the following:
 | White list of Flexvolume drivers                    | [`allowedFlexVolumes`](#flexvolume-drivers) |
 | Allocating an FSGroup that owns the pod's volumes   | [`fsGroup`](#volumes-and-file-systems)      |
 | Requiring the use of a read only root file system   | [`readOnlyRootFilesystem`](#volumes-and-file-systems) |
-| The user and group IDs of the container             | [`runAsUser`, `supplementalGroups`](#users-and-groups) |
+| The user and group IDs of the container             | [`runAsUser`, `runAsGroup`, `supplementalGroups`](#users-and-groups) |
 | Restricting escalation to root privileges           | [`allowPrivilegeEscalation`, `defaultAllowPrivilegeEscalation`](#privilege-escalation) |
 | Linux capabilities                                  | [`defaultAddCapabilities`, `requiredDropCapabilities`, `allowedCapabilities`](#capabilities) |
 | The SELinux context of the container                | [`seLinux`](#selinux)                       |
@@ -230,8 +230,8 @@ Create the rolebinding to grant `fake-user` the `use` verb on the example
 policy:
 
 {{< note >}}
-**Note:** _This is not the recommended way! See the [next section](#run-another-pod)
-for the preferred approach._
+This is not the recommended way! See the [next section](#run-another-pod)
+for the preferred approach.
 {{< /note >}}
 
 ```shell
@@ -442,7 +442,7 @@ allowedHostPaths:
     readOnly: true # only allow read-only mounts
 ```
 
-{{< warning >}}**Warning:** There are many ways a container with unrestricted access to the host
+{{< warning >}}There are many ways a container with unrestricted access to the host
 filesystem can escalate privileges, including reading data from other
 containers, and abusing the credentials of system services, such as Kubelet.
 
@@ -457,7 +457,7 @@ root filesystem (i.e. no writable layer).
 
 ### Flexvolume drivers
 
-This specifies a whiltelist of Flexvolume drivers that are allowed to be used
+This specifies a whitelist of Flexvolume drivers that are allowed to be used
 by flexvolume. An empty list or nil means there is no restriction on the drivers.
 Please make sure [`volumes`](#volumes-and-file-systems) field contains the
 `flexVolume` volume type; no Flexvolume driver is allowed otherwise.

content/en/docs/concepts/policy/resource-quotas.md

@@ -27,7 +27,7 @@ Resource quotas work like this:
 
 - Different teams work in different namespaces.  Currently this is voluntary, but
   support for making this mandatory via ACLs is planned.
-- The administrator creates one or more `ResourceQuotas` for each namespace.
+- The administrator creates one `ResourceQuota` for each namespace.
 - Users create resources (pods, services, etc.) in the namespace, and the quota system
   tracks usage to ensure it does not exceed hard resource limits defined in a `ResourceQuota`.
 - If creating or updating a resource violates a quota constraint, the request will fail with HTTP
@@ -202,7 +202,7 @@ field in the quota spec.
 A quota is matched and consumed only if `scopeSelector` in the quota spec selects the pod.
 
 {{< note >}}
-**Note:** You need to enable the feature gate `ResourceQuotaScopeSelectors`before using resource quotas
+You need to enable the feature gate `ResourceQuotaScopeSelectors`before using resource quotas
 per PriorityClass.
 {{< /note >}}