resolving conflicts

2020-06-16 17:08:15 -04:00
parent 3ad8c45b0b 13ca92d745
commit 7ddedb00a0
1497 changed files with 24525 additions and 14364 deletions
@@ -1,5 +1,6 @@
 ---
 title: "Administer a Cluster"
+description: Learn common tasks for administering a cluster.
 weight: 20
 ---

@@ -1,18 +1,19 @@
 ---
 title: Access Clusters Using the Kubernetes API
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to access clusters using the Kubernetes API.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Accessing the Kubernetes API

@@ -449,5 +450,5 @@ The output will be similar to this:
 }
 ```

-{{% /capture %}}
+

@@ -1,18 +1,19 @@
 ---
 title: Access Services Running on Clusters
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to connect to services running on the Kubernetes cluster.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Accessing services running on the cluster

@@ -132,6 +133,6 @@ You may be able to put an apiserver proxy URL into the address bar of a browser.
  - Some web apps may not work, particularly those with client side javascript that construct URLs in a
    way that is unaware of the proxy path prefix.

-{{% /capture %}}
+


@@ -1,21 +1,22 @@
 ---
 title: Change the default StorageClass
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to change the default Storage Class that is used to
 provision volumes for PersistentVolumeClaims that have no special requirements.

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Why change the default storage class?

@@ -93,10 +94,11 @@ for details about addon manager and how to disable individual addons.
      gold (default)   kubernetes.io/gce-pd      1d
      ```

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+
 * Learn more about [PersistentVolumes](/docs/concepts/storage/persistent-volumes/).
-{{% /capture %}}
+


@@ -1,20 +1,21 @@
 ---
 title: Change the Reclaim Policy of a PersistentVolume
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to change the reclaim policy of a Kubernetes
 PersistentVolume.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Why change reclaim policy of a PersistentVolume

@@ -80,9 +81,10 @@ kubectl patch pv <your-pv-name> -p "{\"spec\":{\"persistentVolumeReclaimPolicy\"
    `default/claim3` has reclaim policy `Retain`. It will not be automatically
    deleted when a user deletes claim `default/claim3`.

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+
 * Learn more about [PersistentVolumes](/docs/concepts/storage/persistent-volumes/).
 * Learn more about [PersistentVolumeClaims](/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims).

@@ -91,6 +93,6 @@ kubectl patch pv <your-pv-name> -p "{\"spec\":{\"persistentVolumeReclaimPolicy\"
 * [PersistentVolume](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#persistentvolume-v1-core)
 * [PersistentVolumeClaim](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#persistentvolumeclaim-v1-core)
 * See the `persistentVolumeReclaimPolicy` field of [PersistentVolumeSpec](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#persistentvolumeclaim-v1-core).
-{{% /capture %}}
+


@@ -3,20 +3,20 @@ reviewers:
 - lavalamp
 - thockin
 title: Cluster Management
-content_template: templates/concept
+content_type: concept
 ---

-{{% capture overview %}}
+<!-- overview -->

 This document describes several topics related to the lifecycle of a cluster: creating a new cluster,
 upgrading your cluster's
 master and worker nodes, performing node maintenance (e.g. kernel upgrades), and upgrading the Kubernetes API version of a
 running cluster.

-{{% /capture %}}


-{{% capture body %}}
+
+<!-- body -->

 ## Creating and configuring a Cluster

@@ -224,4 +224,4 @@ kubectl convert -f pod.yaml --output-version v1

 For more options, please refer to the usage of [kubectl convert](/docs/reference/generated/kubectl/kubectl-commands#convert) command.

-{{% /capture %}}
+
@@ -3,10 +3,10 @@ reviewers:
 - davidopp
 - madhusudancs
 title: Configure Multiple Schedulers
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->

 Kubernetes ships with a default scheduler that is described [here](/docs/admin/kube-scheduler/).
 If the default scheduler does not suit your needs you can implement your own scheduler.
@@ -19,16 +19,17 @@ document. Please refer to the kube-scheduler implementation in
 [pkg/scheduler](https://github.com/kubernetes/kubernetes/tree/{{< param "githubbranch" >}}/pkg/scheduler)
 in the Kubernetes source directory for a canonical example.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Package the scheduler

@@ -219,9 +220,9 @@ kubectl create -f pod3.yaml
 kubectl get pods
 ```

-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->

 ### Verifying that the pods were scheduled using the desired schedulers

@@ -241,4 +242,4 @@ verify that the pods were scheduled by the desired schedulers.
 kubectl get events
 ```

-{{% /capture %}}
+
@@ -3,23 +3,24 @@ reviewers:
 - mml
 - wojtek-t
 title: Operating etcd clusters for Kubernetes
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->

 {{< glossary_definition term_id="etcd" length="all" prepend="etcd is a ">}}

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Prerequisites

@@ -238,4 +239,4 @@ To urgently fix this bug for Kubernetes 1.15 or earlier, build a custom kube-api

 See ["kube-apiserver 1.13.x refuses to work when first etcd-server is not available"](https://github.com/kubernetes/kubernetes/issues/72102).

-{{% /capture %}}
+
@@ -3,18 +3,19 @@ reviewers:
 - johnbelamaric
 title: Using CoreDNS for Service Discovery
 min-kubernetes-server-version: v1.9
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page describes the CoreDNS upgrade process and how to install CoreDNS instead of kube-dns.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+
 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## About CoreDNS

@@ -89,14 +90,15 @@ There is a helpful [guideline and walkthrough](https://github.com/coredns/deploy
 When resource utilisation is a concern, it may be useful to tune the configuration of CoreDNS. For more details, check out the
 [documentation on scaling CoreDNS](https://github.com/coredns/deployment/blob/master/kubernetes/Scaling_CoreDNS.md).

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 You can configure [CoreDNS](https://coredns.io) to support many more use cases than
 kube-dns by modifying the `Corefile`. For more information, see the
 [CoreDNS site](https://coredns.io/2017/05/08/custom-dns-entries-for-kubernetes/).

-{{% /capture %}}
+


@@ -4,10 +4,10 @@ reviewers:
 - sjenning
 - ConnorDoyle
 - balajismaniam
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->

 {{< feature-state for_k8s_version="v1.12" state="beta" >}}

@@ -18,16 +18,17 @@ acceptably. The kubelet provides methods to enable more complex workload
 placement policies while keeping the abstraction free from explicit placement
 directives.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## CPU Management Policies

@@ -211,4 +212,4 @@ and `requests` are set equal to `limits` when not explicitly specified. And the
 container's resource limit for the CPU resource is an integer greater than or
 equal to one. The `nginx` container is granted 2 exclusive CPUs.

-{{% /capture %}}
+
@@ -4,13 +4,14 @@ reviewers:
 - danwinship
 title: Declare Network Policy
 min-kubernetes-server-version: v1.8
-content_template: templates/task
+content_type: task
 ---
-{{% capture overview %}}
+<!-- overview -->
 This document helps you get started using the Kubernetes [NetworkPolicy API](/docs/concepts/services-networking/network-policies/) to declare network policies that govern how pods communicate with each other.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

@@ -25,9 +26,9 @@ Make sure you've configured a network provider with network policy support. Ther
 {{< note >}}
 The above list is sorted alphabetically by product name, not by recommendation or preference. This example is valid for a Kubernetes cluster using any of these providers.
 {{< /note >}}
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Create an `nginx` deployment and expose it via a service

@@ -146,4 +147,4 @@ Connecting to nginx (10.100.0.16:80)
 remote file exists
 ```

-{{% /capture %}}
+
@@ -4,18 +4,18 @@ reviewers:
 - thockin
 - wlan0
 title: Developing Cloud Controller Manager
-content_template: templates/concept
+content_type: concept
 ---

-{{% capture overview %}}
+<!-- overview -->

 {{< feature-state for_k8s_version="v1.11" state="beta" >}}

 {{< glossary_definition term_id="cloud-controller-manager" length="all" prepend="The cloud-controller-manager is">}}

-{{% /capture %}}

-{{% capture body %}}
+
+<!-- body -->

 ## Background

@@ -41,4 +41,4 @@ controller manager as your starting point.

 For in-tree cloud providers, you can run the in-tree cloud controller manager as a {{< glossary_tooltip term_id="daemonset" >}} in your cluster. See [Cloud Controller Manager Administration](/docs/tasks/administer-cluster/running-cloud-controller/) for more details.

-{{% /capture %}}
+
@@ -3,49 +3,54 @@ reviewers:
 - bowei
 - zihongz
 title: Customizing DNS Service
-content_template: templates/task
+content_type: task
+min-kubernetes-server-version: v1.12
 ---

-{{% capture overview %}}
-This page explains how to configure your DNS Pod and customize the
-DNS resolution process. In Kubernetes version 1.11 and later, CoreDNS is at GA
-and is installed by default with kubeadm. See [CoreDNS ConfigMap options](#coredns-configmap-options) 
-and [Using CoreDNS for Service Discovery](/docs/tasks/administer-cluster/coredns/).
-{{% /capture %}}
+<!-- overview -->
+This page explains how to configure your DNS
+{{< glossary_tooltip text="Pod(s)" term_id="pod" >}} and customize the
+DNS resolution process in your cluster.

-{{% capture prerequisites %}}
-* {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
-* Kubernetes version 1.6 or later. To work with CoreDNS, version 1.9 or later.
-* The appropriate add-on: kube-dns or CoreDNS. To install with kubeadm,
-see [the kubeadm reference documentation](/docs/reference/setup-tools/kubeadm/kubeadm-alpha/#cmd-phase-addon).
-{{% /capture %}}
+## {{% heading "prerequisites" %}}

-{{% capture steps %}}
+{{< include "task-tutorial-prereqs.md" >}}
+
+Your cluster must be running the CoreDNS add-on.
+[Migrating to CoreDNS](https://kubernetes.io/docs/tasks/administer-cluster/coredns/#migrating-to-coredns)
+explains how to use `kubeadm` to migrate from `kube-dns`.
+
+{{% version-check %}}
+
+<!-- steps -->

 ## Introduction

 DNS is a built-in Kubernetes service launched automatically
-using the addon manager
+using the _addon manager_
 [cluster add-on](http://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/README.md).

-As of Kubernetes v1.12, CoreDNS is the recommended DNS Server, replacing kube-dns. However, kube-dns may still be installed by
-default with certain Kubernetes installer tools. Refer to the documentation provided by your installer to know which DNS server is installed by default.
+As of Kubernetes v1.12, CoreDNS is the recommended DNS Server, replacing kube-dns. If your cluster
+originally used kube-dns, you may still have `kube-dns` deployed rather than CoreDNS.

+{{< note >}}
+Both the CoreDNS and kube-dns Service are named `kube-dns` in the `metadata.name` field.  
+This is so that there is greater interoperability with workloads that relied on the legacy `kube-dns` Service name to resolve addresses internal to the cluster. Using a Service named `kube-dns` abstracts away the implementation detail of which DNS provider is running behind that common name.
+{{< /note >}}

-The CoreDNS Deployment is exposed as a Kubernetes Service with a static IP.
-Both the CoreDNS and kube-dns Service are named `kube-dns` in the `metadata.name` field. This is done so that there is greater interoperability with workloads that relied on the legacy `kube-dns` Service name to resolve addresses internal to the cluster. It abstracts away the implementation detail of which DNS provider is running behind that common endpoint. 
-The kubelet passes DNS to each container with the `--cluster-dns=<dns-service-ip>` flag.
+If you are running CoreDNS as a Deployment, it will typically be exposed as a Kubernetes Service with a static IP address.
+The kubelet passes DNS resolver information to each container with the `--cluster-dns=<dns-service-ip>` flag.

 DNS names also need domains. You configure the local domain in the kubelet
 with the flag `--cluster-domain=<default-local-domain>`.

-The DNS server supports forward lookups (A records), port lookups (SRV records), reverse IP address lookups (PTR records),
-and more. For more information see [DNS for Services and Pods] (/docs/concepts/services-networking/dns-pod-service/).
+The DNS server supports forward lookups (A and AAAA records), port lookups (SRV records), reverse IP address lookups (PTR records),
+and more. For more information, see [DNS for Services and Pods](/docs/concepts/services-networking/dns-pod-service/).

-If a Pod's `dnsPolicy` is set to "`default`", it inherits the name resolution
+If a Pod's `dnsPolicy` is set to `default`, it inherits the name resolution
 configuration from the node that the Pod runs on. The Pod's DNS resolution
 should behave the same as the node.
-But see [Known issues](/docs/tasks/administer-cluster/dns-debugging-resolution/#known-issues).
+But see [Known issues](/docs/tasks/debug-application-cluster/dns-debugging-resolution/#known-issues).

 If you don't want this, or if you want a different DNS config for pods, you can
 use the kubelet's `--resolv-conf` flag.  Set this flag to "" to prevent Pods from
@@ -58,11 +63,13 @@ CoreDNS is a general-purpose authoritative DNS server that can serve as cluster

 ### CoreDNS ConfigMap options

-CoreDNS is a DNS server that is modular and pluggable, and each plugin adds new functionality to CoreDNS. 
+CoreDNS is a DNS server that is modular and pluggable, and each plugin adds new functionality to CoreDNS.
 This can be configured by maintaining a [Corefile](https://coredns.io/2017/07/23/corefile-explained/), which is the CoreDNS
-configuration file. A cluster administrator can modify the ConfigMap for the CoreDNS Corefile to change how service discovery works. 
+configuration file. As a cluster administrator, you can modify the
+{{< glossary_tooltip text="ConfigMap" term_id="configmap" >}} for the CoreDNS Corefile to change how DNS service discovery
+behaves for that cluster.

-In Kubernetes, CoreDNS is installed with the following default Corefile configuration.
+In Kubernetes, CoreDNS is installed with the following default Corefile configuration:

 ```yaml
 apiVersion: v1
@@ -90,17 +97,16 @@ data:
        reload
        loadbalance
    }
-``` 
+```
+
 The Corefile configuration includes the following [plugins](https://coredns.io/plugins/) of CoreDNS:

 * [errors](https://coredns.io/plugins/errors/): Errors are logged to stdout.
-* [health](https://coredns.io/plugins/health/): Health of CoreDNS is reported to http://localhost:8080/health. In this extended syntax `lameduck` will make the process unhealthy then wait for 5 seconds before the process is shut down.
+* [health](https://coredns.io/plugins/health/): Health of CoreDNS is reported to `http://localhost:8080/health`. In this extended syntax `lameduck` will make the process unhealthy then wait for 5 seconds before the process is shut down.
 * [ready](https://coredns.io/plugins/ready/): An HTTP endpoint on port 8181 will return 200 OK, when all plugins that are able to signal readiness have done so.
-* [kubernetes](https://coredns.io/plugins/kubernetes/): CoreDNS will reply to DNS queries based on IP of the services and pods of Kubernetes. You can find more details [here](https://coredns.io/plugins/kubernetes/). `ttl` allows you to set a custom TTL for responses. The default is 5 seconds. The minimum TTL allowed is 0 seconds, and the maximum is capped at 3600 seconds. Setting TTL to 0 will prevent records from being cached.
-
-> The `pods insecure` option is provided for backward compatibility with kube-dns. You can use the `pods verified` option, which returns an A record only if there exists a pod in same namespace with matching IP. The `pods disabled` option can be used if you don't use pod records.
-
-* [prometheus](https://coredns.io/plugins/metrics/): Metrics of CoreDNS are available at http://localhost:9153/metrics in [Prometheus](https://prometheus.io/) format.
+* [kubernetes](https://coredns.io/plugins/kubernetes/): CoreDNS will reply to DNS queries based on IP of the services and pods of Kubernetes. You can find [more details](https://coredns.io/plugins/kubernetes/) about that plugin on the CoreDNS website. `ttl` allows you to set a custom TTL for responses. The default is 5 seconds. The minimum TTL allowed is 0 seconds, and the maximum is capped at 3600 seconds. Setting TTL to 0 will prevent records from being cached.  
+  The `pods insecure` option is provided for backward compatibility with _kube-dns_. You can use the `pods verified` option, which returns an A record only if there exists a pod in same namespace with matching IP. The `pods disabled` option can be used if you don't use pod records.
+* [prometheus](https://coredns.io/plugins/metrics/): Metrics of CoreDNS are available at `http://localhost:9153/metrics` in [Prometheus](https://prometheus.io/) format (also known as OpenMetrics).
 * [forward](https://coredns.io/plugins/forward/): Any queries that are not within the cluster domain of Kubernetes will be forwarded to predefined resolvers (/etc/resolv.conf).
 * [cache](https://coredns.io/plugins/cache/): This enables a frontend cache.
 * [loop](https://coredns.io/plugins/loop/): Detects simple forwarding loops and halts the CoreDNS process if a loop is found.
@@ -128,7 +134,7 @@ To explicitly force all non-cluster DNS lookups to go through a specific nameser

 ```
 forward .  172.16.0.1
-``` 
+```

 The final ConfigMap along with the default `Corefile` configuration looks like:

@@ -160,149 +166,14 @@ data:
        forward . 10.150.0.1
    }
 ```
-In Kubernetes version 1.10 and later, kubeadm supports automatic translation of the CoreDNS ConfigMap from the kube-dns ConfigMap.
-***Note: While kube-dns accepts an FQDN for stubdomain and nameserver (eg: ns.foo.com), CoreDNS does not support this feature. 
-During translation, all FQDN nameservers will be omitted from the CoreDNS config.***

-## Kube-dns
+The `kubeadm` tool supports automatic translation from the kube-dns ConfigMap
+to the equivalent CoreDNS ConfigMap.

-Kube-dns is now available as an optional DNS server since CoreDNS is now the default.
-The running DNS Pod holds 3 containers:
-
- "`kubedns`": watches the Kubernetes master for changes
-  in Services and Endpoints, and maintains in-memory lookup structures to serve
-  DNS requests.
- "`dnsmasq`": adds DNS caching to improve performance.
- "`sidecar`": provides a single health check endpoint
-  to perform healthchecks for `dnsmasq` and `kubedns`.
-
-### Configure stub-domain and upstream DNS servers
-
-Cluster administrators can specify custom stub domains and upstream nameservers
-by providing a ConfigMap for kube-dns (`kube-system:kube-dns`).
-
-For example, the following ConfigMap sets up a DNS configuration with a single stub domain and two
-upstream nameservers:
-
-```yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kube-dns
-  namespace: kube-system
-data:
-  stubDomains: |
-    {"acme.local": ["1.2.3.4"]}
-  upstreamNameservers: |
-    ["8.8.8.8", "8.8.4.4"]
-```
-
-DNS requests with the “.acme.local” suffix
-are forwarded to a DNS listening at 1.2.3.4. Google Public DNS
-serves the upstream queries.
-
-The table below describes how queries with certain domain names map to
-their destination DNS servers:
-
-| Domain name | Server answering the query |
-| ----------- | -------------------------- |
-| kubernetes.default.svc.cluster.local| kube-dns |
-| foo.acme.local| custom DNS (1.2.3.4) |
-| widget.com    | upstream DNS (one of 8.8.8.8, 8.8.4.4) |
-
-See [ConfigMap options](#configmap-options) for
-details about the configuration option format.
-
-{{% /capture %}}
-
-{{% capture discussion %}}
-
-#### Effects on Pods
-
-Custom upstream nameservers and stub domains do not affect Pods with a
-`dnsPolicy` set to "`Default`" or "`None`".
-
-If a Pod's `dnsPolicy` is set to "`ClusterFirst`", its name resolution is
-handled differently, depending on whether stub-domain and upstream DNS servers
-are configured.
-
-**Without custom configurations**: Any query that does not match the configured
-cluster domain suffix, such as "www.kubernetes.io", is forwarded to the upstream
-nameserver inherited from the node.
-
-**With custom configurations**: If stub domains and upstream DNS servers are
-configured,
-DNS queries are routed according to the following flow:
-
-1. The query is first sent to the DNS caching layer in kube-dns.
-
-1. From the caching layer, the suffix of the request is examined and then
-   forwarded to the appropriate DNS, based on the following cases:
-
-   * *Names with the cluster suffix*, for example ".cluster.local":
-     The request is sent to kube-dns.
-
-   * *Names with the stub domain suffix*, for example ".acme.local":
-     The request is sent to the configured custom DNS resolver, listening for example at 1.2.3.4.
-
-   * *Names without a matching suffix*, for example "widget.com":
-     The request is forwarded to the upstream DNS,
-     for example Google public DNS servers at 8.8.8.8 and 8.8.4.4.
-
-![DNS lookup flow](/docs/tasks/administer-cluster/dns-custom-nameservers/dns.png)
-
-### ConfigMap options
-
-Options for the kube-dns `kube-system:kube-dns` ConfigMap:
-
-| Field | Format | Description |
-| ----- | ------ | ----------- |
-| `stubDomains` (optional) | A JSON map using a DNS suffix key such as “acme.local”, and a value consisting of a JSON array of DNS IPs. | The target nameserver can itself be a Kubernetes Service. For instance, you can run your own copy of dnsmasq to export custom DNS names into the ClusterDNS namespace. |
-| `upstreamNameservers` (optional) | A JSON array of DNS IPs. | If specified, the values replace the nameservers taken by default from the node’s `/etc/resolv.conf`. Limits: a maximum of three upstream nameservers can be specified. |
-
-#### Examples
-
-##### Example: Stub domain
-
-In this example, the user has a Consul DNS service discovery system they want to
-integrate with kube-dns. The consul domain server is located at 10.150.0.1, and
-all consul names have the suffix `.consul.local`.  To configure Kubernetes, the
-cluster administrator creates the following ConfigMap:
-
-```yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kube-dns
-  namespace: kube-system
-data:
-  stubDomains: |
-    {"consul.local": ["10.150.0.1"]}
-```
-
-Note that the cluster administrator does not want to override the node’s
-upstream nameservers, so they did not specify the optional
-`upstreamNameservers` field.
-
-##### Example: Upstream nameserver
-
-In this example the cluster administrator wants to explicitly force all
-non-cluster DNS lookups to go through their own nameserver at 172.16.0.1.
-In this case, they create a ConfigMap with the
-`upstreamNameservers` field specifying the desired nameserver:
-
-```yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kube-dns
-  namespace: kube-system
-data:
-  upstreamNameservers: |
-    ["172.16.0.1"]
-```
-
-{{% /capture %}}
+{{< note >}}
+While kube-dns accepts an FQDN for stubdomain and nameserver (eg: ns.foo.com), CoreDNS does not support this feature.
+During translation, all FQDN nameservers will be omitted from the CoreDNS config.
+{{< /note >}}

 ## CoreDNS configuration equivalent to kube-dns

@@ -312,7 +183,7 @@ Similarly, the `Federations` plugin in kube-dns translates to the `federation` p

 ### Example

-This example ConfigMap for kubedns specifies federations, stubdomains and upstreamnameservers:
+This example ConfigMap for kube-dns specifies federations, stubdomains and upstreamnameservers:

 ```yaml
 apiVersion: v1
@@ -329,59 +200,65 @@ kind: ConfigMap
 The equivalent configuration in CoreDNS creates a Corefile:

 * For federations:
-```yaml
+```
 federation cluster.local {
-           foo foo.feddomain.com
-        }
+    foo foo.feddomain.com
+}
 ```

 * For stubDomains:
 ```yaml
 abc.com:53 {
-        errors
-        cache 30
-        forward . 1.2.3.4
-    }
-    my.cluster.local:53 {
-        errors
-        cache 30
-        forward . 2.3.4.5
-    }
+    errors
+    cache 30
+    forward . 1.2.3.4
+}
+my.cluster.local:53 {
+    errors
+    cache 30
+    forward . 2.3.4.5
+}
 ```

 The complete Corefile with the default plugins:

-```yaml
+```
 .:53 {
-        errors
-        health
-        kubernetes cluster.local in-addr.arpa ip6.arpa {
-           pods insecure
-           fallthrough in-addr.arpa ip6.arpa
-        }
-        federation cluster.local {
-           foo foo.feddomain.com
-        }
-        prometheus :9153
-        forward .  8.8.8.8 8.8.4.4
-        cache 30
+    errors
+    health
+    kubernetes cluster.local in-addr.arpa ip6.arpa {
+        pods insecure
+        fallthrough in-addr.arpa ip6.arpa
    }
-    abc.com:53 {
-        errors
-        cache 30
-        forward . 1.2.3.4
-    }
-    my.cluster.local:53 {
-        errors
-        cache 30
-        forward . 2.3.4.5
+    federation cluster.local {
+        foo foo.feddomain.com
    }
+    prometheus :9153
+    forward . 8.8.8.8 8.8.4.4
+    cache 30
+}
+abc.com:53 {
+    errors
+    cache 30
+    forward . 1.2.3.4
+}
+my.cluster.local:53 {
+    errors
+    cache 30
+    forward . 2.3.4.5
+}
 ```

 ## Migration to CoreDNS

-To migrate from kube-dns to CoreDNS, [a detailed blog](https://coredns.io/2018/05/21/migration-from-kube-dns-to-coredns/) is available to help users adapt CoreDNS in place of kube-dns.
-A cluster administrator can also migrate using [the deploy script](https://github.com/coredns/deployment/blob/master/kubernetes/deploy.sh).
+To migrate from kube-dns to CoreDNS, a detailed
+[blog article](https://coredns.io/2018/05/21/migration-from-kube-dns-to-coredns/)
+is available to help users adapt CoreDNS in place of kube-dns.

-## What's next
- [Debugging DNS Resolution](/docs/tasks/administer-cluster/dns-debugging-resolution/).
+You can also migrate using the offical CoreDNS
+[deploy script](https://github.com/coredns/deployment/blob/master/kubernetes/deploy.sh).
+
+
+## {{% heading "whatsnext" %}}
+
+- Read [Debugging DNS Resolution](/docs/tasks/debug-application-cluster/dns-debugging-resolution/)
@@ -1,277 +0,0 @@
---
-reviewers:
- bowei
- zihongz
-title:  Debugging DNS Resolution
-content_template: templates/task
---
-
-{{% capture overview %}}
-This page provides hints on diagnosing DNS problems.
-{{% /capture %}}
-
-{{% capture prerequisites %}}
-* {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
-* Kubernetes version 1.6 and above.
-* The cluster must be configured to use the `coredns` (or `kube-dns`) addons.
-{{% /capture %}}
-
-{{% capture steps %}}
-
-### Create a simple Pod to use as a test environment
-
-Create a file named dnsutils.yaml with the following contents:
-
-{{< codenew file="admin/dns/dnsutils.yaml" >}}
-
-Then create a pod using this file and verify its status:
-
-```shell
-kubectl apply -f https://k8s.io/examples/admin/dns/dnsutils.yaml
-pod/dnsutils created
-
-kubectl get pods dnsutils
-NAME      READY     STATUS    RESTARTS   AGE
-dnsutils   1/1       Running   0          <some-time>
-```
-
-Once that pod is running, you can exec `nslookup` in that environment.
-If you see something like the following, DNS is working correctly.
-
-```shell
-kubectl exec -ti dnsutils -- nslookup kubernetes.default
-Server:    10.0.0.10
-Address 1: 10.0.0.10
-
-Name:      kubernetes.default
-Address 1: 10.0.0.1
-```
-
-If the `nslookup` command fails, check the following:
-
-### Check the local DNS configuration first
-
-Take a look inside the resolv.conf file.
-(See [Inheriting DNS from the node](/docs/tasks/administer-cluster/dns-custom-nameservers/#inheriting-dns-from-the-node) and
-[Known issues](#known-issues) below for more information)
-
-```shell
-kubectl exec -ti dnsutils -- cat /etc/resolv.conf
-```
-
-Verify that the search path and name server are set up like the following
-(note that search path may vary for different cloud providers):
-
-```
-search default.svc.cluster.local svc.cluster.local cluster.local google.internal c.gce_project_id.internal
-nameserver 10.0.0.10
-options ndots:5
-```
-
-Errors such as the following indicate a problem with the coredns/kube-dns add-on or
-associated Services:
-
-```
-kubectl exec -ti dnsutils -- nslookup kubernetes.default
-Server:    10.0.0.10
-Address 1: 10.0.0.10
-
-nslookup: can't resolve 'kubernetes.default'
-```
-
-or
-
-```
-kubectl exec -ti dnsutils -- nslookup kubernetes.default
-Server:    10.0.0.10
-Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local
-
-nslookup: can't resolve 'kubernetes.default'
-```
-
-### Check if the DNS pod is running
-
-Use the `kubectl get pods` command to verify that the DNS pod is running.
-
-For CoreDNS:
-```shell
-kubectl get pods --namespace=kube-system -l k8s-app=kube-dns
-NAME                       READY     STATUS    RESTARTS   AGE
-...
-coredns-7b96bf9f76-5hsxb   1/1       Running   0           1h
-coredns-7b96bf9f76-mvmmt   1/1       Running   0           1h
-...
-```
-
-Or for kube-dns:
-```shell
-kubectl get pods --namespace=kube-system -l k8s-app=kube-dns
-NAME                    READY     STATUS    RESTARTS   AGE
-...
-kube-dns-v19-ezo1y      3/3       Running   0           1h
-...
-```
-
-If you see that no pod is running or that the pod has failed/completed, the DNS
-add-on may not be deployed by default in your current environment and you will
-have to deploy it manually.
-
-### Check for Errors in the DNS pod
-
-Use `kubectl logs` command to see logs for the DNS containers.
-
-For CoreDNS:
-```shell
-for p in $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name); do kubectl logs --namespace=kube-system $p; done
-```
-
-Here is an example of a healthy CoreDNS log:
-
-```
-.:53
-2018/08/15 14:37:17 [INFO] CoreDNS-1.2.2
-2018/08/15 14:37:17 [INFO] linux/amd64, go1.10.3, 2e322f6
-CoreDNS-1.2.2
-linux/amd64, go1.10.3, 2e322f6
-2018/08/15 14:37:17 [INFO] plugin/reload: Running configuration MD5 = 24e6c59e83ce706f07bcc82c31b1ea1c
-```
-
-
-For kube-dns, there are 3 sets of logs:
-```shell
-kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c kubedns
-
-kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c dnsmasq
-
-kubectl logs --namespace=kube-system $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name | head -1) -c sidecar
-```
-
-See if there are any suspicious error messages in the logs. In kube-dns, a '`W`', '`E`' or '`F`' at the beginning
-of a line represents a Warning, Error or Failure. Please search for entries that have these
-as the logging level and use
-[kubernetes issues](https://github.com/kubernetes/kubernetes/issues)
-to report unexpected errors.
-
-### Is DNS service up?
-
-Verify that the DNS service is up by using the `kubectl get service` command.
-
-```shell
-kubectl get svc --namespace=kube-system
-NAME         TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)             AGE
-...
-kube-dns     ClusterIP   10.0.0.10      <none>        53/UDP,53/TCP        1h
-...
-```
-
-
-Note that the service name will be "kube-dns" for both CoreDNS and kube-dns deployments.
-If you have created the service or in the case it should be created by default
-but it does not appear, see 
-[debugging services](/docs/tasks/debug-application-cluster/debug-service/) for
-more information.
-
-### Are DNS endpoints exposed?
-
-You can verify that DNS endpoints are exposed by using the `kubectl get endpoints`
-command.
-
-```shell
-kubectl get ep kube-dns --namespace=kube-system
-NAME       ENDPOINTS                       AGE
-kube-dns   10.180.3.17:53,10.180.3.17:53    1h
-```
-
-If you do not see the endpoints, see endpoints section in the
-[debugging services](/docs/tasks/debug-application-cluster/debug-service/) documentation.
-
-For additional Kubernetes DNS examples, see the
-[cluster-dns examples](https://github.com/kubernetes/examples/tree/master/staging/cluster-dns)
-in the Kubernetes GitHub repository.
-
-
-### Are DNS queries being received/processed?
-
-You can verify if queries are being received by CoreDNS by adding the `log` plugin to the CoreDNS configuration (aka Corefile).
-The CoreDNS Corefile is held in a ConfigMap named `coredns`. To edit it, use the command ...
-
-```
-kubectl -n kube-system edit configmap coredns
-```
-
-Then add `log` in the Corefile section per the example below.
-
-```
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: coredns
-  namespace: kube-system
-data:
-  Corefile: |
-    .:53 {
-        log
-        errors
-        health
-        kubernetes cluster.local in-addr.arpa ip6.arpa {
-          pods insecure
-          upstream
-          fallthrough in-addr.arpa ip6.arpa
-        }
-        prometheus :9153
-        proxy . /etc/resolv.conf
-        cache 30
-        loop
-        reload
-        loadbalance
-    }
-
-```
-
-After saving the changes, it may take up to minute or two for Kubernetes to propagate these changes to the CoreDNS pods.
-
-Next, make some queries and view the logs per the sections above in this document. If CoreDNS pods are receiving the queries, you should see them in the logs.
-
-Here is an example of a query in the log.
-
-```
-.:53
-2018/08/15 14:37:15 [INFO] CoreDNS-1.2.0
-2018/08/15 14:37:15 [INFO] linux/amd64, go1.10.3, 2e322f6
-CoreDNS-1.2.0
-linux/amd64, go1.10.3, 2e322f6
-2018/09/07 15:29:04 [INFO] plugin/reload: Running configuration MD5 = 162475cdf272d8aa601e6fe67a6ad42f
-2018/09/07 15:29:04 [INFO] Reloading complete
-172.17.0.18:41675 - [07/Sep/2018:15:29:11 +0000] 59925 "A IN kubernetes.default.svc.cluster.local. udp 54 false 512" NOERROR qr,aa,rd,ra 106 0.000066649s
-
-```
-
-## Known issues
-
-Some Linux distributions (e.g. Ubuntu) use a local DNS resolver by default (systemd-resolved).
-Systemd-resolved moves and replaces `/etc/resolv.conf` with a stub file that can cause a fatal forwarding
-loop when resolving names in upstream servers. This can be fixed manually by using kubelet's `--resolv-conf` flag
-to point to the correct `resolv.conf` (With `systemd-resolved`, this is `/run/systemd/resolve/resolv.conf`).
-kubeadm (>= 1.11) automatically detects `systemd-resolved`, and adjusts the kubelet flags accordingly.
-
-Kubernetes installs do not configure the nodes' `resolv.conf` files to use the
-cluster DNS by default, because that process is inherently distribution-specific.
-This should probably be implemented eventually.
-
-Linux's libc (a.k.a. glibc) has a limit for the DNS `nameserver` records to 3 by default. What's more, for the glibc versions which are older than glibc-2.17-222 ([the new versions update see this issue](https://access.redhat.com/solutions/58028)), the allowed number of DNS `search` records has been limited to 6 ([see this bug from 2005](https://bugzilla.redhat.com/show_bug.cgi?id=168253)). Kubernetes needs to consume 1 `nameserver` record and 3 `search` records. This means that if a local installation already uses 3 `nameserver`s or uses more than 3 `search`es while your glibc version is in the affected list, some of those settings will be lost. To work around the DNS `nameserver` records limit, the node can run `dnsmasq`, which will provide more `nameserver` entries. You can also use kubelet's `--resolv-conf` flag. To fix the DNS `search` records limit, consider upgrading your linux distribution or upgrading to an unaffected version of glibc.
-
-If you are using Alpine version 3.3 or earlier as your base image, DNS may not
-work properly due to a known issue with Alpine.
-Check [here](https://github.com/kubernetes/kubernetes/issues/30215)
-for more information.
-
-## References
-
- [DNS for Services and Pods](/docs/concepts/services-networking/dns-pod-service/)
- [Docs for the kube-dns DNS cluster addon](http://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/dns/kube-dns/README.md)
-
-## What's next
- [Autoscaling the DNS Service in a Cluster](/docs/tasks/administer-cluster/dns-horizontal-autoscaling/).
-
-{{% /capture %}}
-
@@ -1,14 +1,15 @@
 ---
 title: Autoscale the DNS Service in a Cluster
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to enable and configure autoscaling of the DNS service in
 your Kubernetes cluster.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 * {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

@@ -16,9 +17,9 @@ your Kubernetes cluster.

 * Make sure [Kubernetes DNS](/docs/concepts/services-networking/dns-pod-service/) is enabled.

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Determine whether DNS horizontal autoscaling is already enabled {#determining-whether-dns-horizontal-autoscaling-is-already-enabled}

@@ -201,9 +202,9 @@ The common path for this dns-autoscaler is:
 After the manifest file is deleted, the Addon Manager will delete the
 dns-autoscaler Deployment.

-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->

 ## Understanding how DNS horizontal autoscaling works

@@ -226,10 +227,11 @@ the autoscaler Pod.
 * The autoscaler provides a controller interface to support two control
 patterns: *linear* and *ladder*.

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+
 * Read about [Guaranteed Scheduling For Critical Add-On Pods](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/).
 * Learn more about the
 [implementation of cluster-proportional-autoscaler](https://github.com/kubernetes-incubator/cluster-proportional-autoscaler).
-{{% /capture %}}
+
@@ -3,19 +3,20 @@ reviewers:
 - bowei
 - freehan
 title: Enabling EndpointSlices
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page provides an overview of enabling EndpointSlices in Kubernetes.
-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+
  {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Introduction

@@ -55,9 +56,10 @@ existing Endpoints functionality, EndpointSlices include new bits of information
 such as topology. They will allow for greater scalability and extensibility of
 network endpoints in your cluster.

-{{% capture whatsnext %}}
+## {{% heading "whatsnext" %}}
+

 * Read about [EndpointSlices](/docs/concepts/services-networking/endpoint-slices/)
 * Read [Connecting Applications with Services](/docs/concepts/services-networking/connect-applications-service/)

-{{% /capture %}}
+
@@ -4,19 +4,20 @@ reviewers:
 - johnbelamaric
 - imroc
 title: Enabling Service Topology
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page provides an overview of enabling Service Topology in Kubernetes.
-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+
  {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Introduction

@@ -45,10 +46,11 @@ To enable service topology, enable the `ServiceTopology` and `EndpointSlice` fea
 ```


-{{% capture whatsnext %}}
+## {{% heading "whatsnext" %}}
+

 * Read about the [Service Topology](/docs/concepts/services-networking/service-topology) concept
 * Read about [Endpoint Slices](/docs/concepts/services-networking/endpoint-slices)
 * Read [Connecting Applications with Services](/docs/concepts/services-networking/connect-applications-service/)

-{{% /capture %}}
+
@@ -2,23 +2,24 @@
 reviewers:
 - smarterclayton
 title: Encrypting Secret Data at Rest
-content_template: templates/task
+content_type: task
 min-kubernetes-server-version: 1.13
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to enable and configure encryption of secret data at rest.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 * {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

 * etcd v3.0 or later is required

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Configuration and determining whether encryption at rest is already enabled

@@ -215,4 +216,4 @@ kubectl get secrets --all-namespaces -o json | kubectl replace -f -
 ```
 to force all secrets to be decrypted.

-{{% /capture %}}
+
@@ -1,26 +1,27 @@
 ---
 title: Advertise Extended Resources for a Node
-content_template: templates/task
+content_type: task
 ---


-{{% capture overview %}}
+<!-- overview -->

 This page shows how to specify extended resources for a Node.
 Extended resources allow cluster administrators to advertise node-level
 resources that would otherwise be unknown to Kubernetes.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}


-{{% capture steps %}}
+
+<!-- steps -->

 ## Get the names of your Nodes

@@ -189,10 +190,11 @@ kubectl describe node <your-node-name> | grep dongle

 (you should not see any output)

-{{% /capture %}}


-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 ### For application developers

@@ -204,4 +206,4 @@ kubectl describe node <your-node-name> | grep dongle
 * [Configure Minimum and Maximum CPU Constraints for a Namespace](/docs/tasks/administer-cluster/cpu-constraint-namespace/)


-{{% /capture %}}
+
@@ -4,10 +4,10 @@ reviewers:
 - filipg
 - piosz
 title: Guaranteed Scheduling For Critical Add-On Pods
-content_template: templates/concept
+content_type: concept
 ---

-{{% capture overview %}}
+<!-- overview -->

 In addition to Kubernetes core components like api-server, scheduler, controller-manager running on a master machine
 there are a number of add-ons which, for various reasons, must run on a regular cluster node (rather than the Kubernetes master).
@@ -19,14 +19,14 @@ vacated by the evicted critical add-on pod or the amount of resources available
 Note that marking a pod as critical is not meant to prevent evictions entirely; it only prevents the pod from becoming permanently unavailable.
 For static pods, this means it can't be evicted, but for non-static pods, it just means they will always be rescheduled.

-{{% /capture %}}


-{{% capture body %}}
+
+<!-- body -->


 ### Marking pod as critical

 To mark a Pod as critical, set priorityClassName for that Pod to `system-cluster-critical` or `system-node-critical`. `system-node-critical` is the highest available priority, even higher than `system-cluster-critical`.

-{{% /capture %}}
+
@@ -2,26 +2,27 @@
 reviewers:
 - jszczepkowski
 title: Set up High-Availability Kubernetes Masters
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->

 {{< feature-state for_k8s_version="v1.5" state="alpha" >}}

 You can replicate Kubernetes masters in `kube-up` or `kube-down` scripts for Google Compute Engine.
 This document describes how to use kube-up/down scripts to manage highly available (HA) masters and how HA masters are implemented for use with GCE.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Starting an HA-compatible cluster

@@ -118,9 +119,9 @@ If the cluster is large, it may take a long time to duplicate its state.
 This operation may be sped up by migrating etcd data directory, as described [here](https://coreos.com/etcd/docs/latest/admin_guide.html#member-migration)
 (we are considering adding support for etcd data dir migration in future).

-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->

 ## Implementation notes

@@ -173,4 +174,4 @@ To make such deployment secure, communication between etcd instances is authoriz

 [Automated HA master deployment - design doc](https://git.k8s.io/community/contributors/design-proposals/cluster-lifecycle/ha_master.md)

-{{% /capture %}}
+
@@ -1,19 +1,20 @@
 ---
 title: IP Masquerade Agent User Guide
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to configure and enable the ip-masq-agent.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->
 ## IP Masquerade Agent User Guide

 The ip-masq-agent configures iptables rules to hide a pod's IP address behind the cluster node's IP address. This is typically done when sending traffic to destinations outside the cluster's pod [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) range.
@@ -53,9 +54,9 @@ MASQUERADE  all  --  anywhere             anywhere             /* ip-masq-agent:

 By default, in GCE/Google Kubernetes Engine starting with Kubernetes version 1.7.0, if network policy is enabled or you are using a cluster CIDR not in the 10.0.0.0/8 range, the ip-masq-agent will run in your cluster.  If you are running in another environment, you can add the ip-masq-agent [DaemonSet](/docs/concepts/workloads/controllers/daemonset/) to your cluster:

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Create an ip-masq-agent
 To create an ip-masq-agent, run the following kubectl command:
@@ -110,4 +111,4 @@ nonMasqueradeCIDRs:
 resyncInterval: 60s
 masqLinkLocal: true
 ```
-{{% /capture %}}
+
@@ -2,13 +2,14 @@
 reviewers:
 - smarterclayton
 title: Using a KMS provider for data encryption
-content_template: templates/task
+content_type: task
 ---
-{{% capture overview %}}
+<!-- overview -->
 This page shows how to configure a Key Management Service (KMS) provider and plugin to enable secret data encryption.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 * {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

@@ -18,9 +19,9 @@ This page shows how to configure a Key Management Service (KMS) provider and plu

 {{< feature-state for_k8s_version="v1.12" state="beta" >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 The KMS encryption provider uses an envelope encryption scheme to encrypt data in etcd. The data is encrypted using a data encryption key (DEK); a new DEK is generated for each encryption. The DEKs are encrypted with a key encryption key (KEK) that is stored and managed in a remote KMS. The KMS provider uses gRPC to communicate with a specific KMS 
 plugin. The KMS plugin, which is implemented as a gRPC server and deployed on the same host(s) as the Kubernetes master(s), is responsible for all communication with the remote KMS.
@@ -183,4 +184,4 @@ To disable encryption at rest:
 ```
 kubectl get secrets --all-namespaces -o json | kubectl replace -f -
 ```
-{{% /capture %}}
+
@@ -4,20 +4,21 @@ reviewers:
 - patricklang
 title: Adding Windows nodes
 min-kubernetes-server-version: 1.17
-content_template: templates/tutorial
+content_type: tutorial
 weight: 30
 ---

-{{% capture overview %}}
+<!-- overview -->

 {{< feature-state for_k8s_version="v1.18" state="beta" >}}

 You can use Kubernetes to run a mixture of Linux and Windows nodes, so you can mix Pods that run on Linux on with Pods that run on Windows. This page shows how to register Windows nodes to your cluster.

-{{% /capture %}}


-{{% capture prerequisites %}} {{< version-check >}}
+
+## {{% heading "prerequisites" %}}
+ {{< version-check >}}

 * Obtain a [Windows Server 2019 license](https://www.microsoft.com/en-us/cloud-platform/windows-server-pricing)
 (or higher) in order to configure the Windows node that hosts Windows containers.
@@ -25,18 +26,19 @@ If you are using VXLAN/Overlay networking you must have also have [KB4489899](ht

 * A Linux-based Kubernetes kubeadm cluster in which you have access to the control plane (see [Creating a single control-plane cluster with kubeadm](/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/)).

-{{% /capture %}}


-{{% capture objectives %}}
+
+## {{% heading "objectives" %}}
+

 * Register a Windows node to the cluster
 * Configure networking so Pods and Services on Linux and Windows can communicate with each other

-{{% /capture %}}


-{{% capture lessoncontent %}}
+
+<!-- lessoncontent -->

 ## Getting Started: Adding a Windows Node to Your Cluster

@@ -176,10 +178,11 @@ kubectl -n kube-system get pods -l app=flannel

 Once the flannel Pod is running, your node should enter the `Ready` state and then be available to handle workloads.

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 - [Upgrading Windows kubeadm nodes](/docs/tasks/administer-cluster/kubeadm/upgrading-windows-nodes)

-{{% /capture %}}
+
@@ -2,25 +2,26 @@
 reviewers:
 - sig-cluster-lifecycle
 title: Certificate Management with kubeadm
-content_template: templates/task
+content_type: task
 weight: 10
 ---

-{{% capture overview %}}
+<!-- overview -->

 {{< feature-state for_k8s_version="v1.15" state="stable" >}}

 Client certificates generated by [kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm/) expire after 1 year. This page explains how to manage certificate renewals with kubeadm.

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 You should be familiar with [PKI certificates and requirements in Kubernetes](/docs/setup/best-practices/certificates/).

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Using custom certificates {#custom-certificates}

@@ -242,4 +243,8 @@ After a certificate is signed using your preferred method, the certificate and t
 [cert-cas]: /docs/setup/best-practices/certificates/#single-root-ca
 [cert-table]: /docs/setup/best-practices/certificates/#all-certificates

-{{% /capture %}}
+## Certificate authority (CA) rotation {#certificate-authority-rotation}
+
+Kubeadm does not support rotation or replacement of CA certificates out of the box.
+
+For more information about manual rotation or replacement of CA, see [manual rotation of CA certificates](/docs/tasks/tls/manual-rotation-of-ca-certificates/).
@@ -2,12 +2,12 @@
 reviewers:
 - sig-cluster-lifecycle
 title: Upgrading kubeadm clusters
-content_template: templates/task
+content_type: task
 weight: 20
 min-kubernetes-server-version: 1.18
 ---

-{{% capture overview %}}
+<!-- overview -->

 This page explains how to upgrade a Kubernetes cluster created with kubeadm from version
 1.17.x to version 1.18.x, and from version 1.18.x to 1.18.y (where `y > x`).
@@ -26,9 +26,10 @@ The upgrade workflow at high level is the following:
 1. Upgrade additional control plane nodes.
 1. Upgrade worker nodes.

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 - You need to have a kubeadm Kubernetes cluster running version 1.17.0 or later.
 - [Swap must be disabled](https://serverfault.com/questions/684771/best-way-to-disable-swap-in-linux).
@@ -44,9 +45,9 @@ The upgrade workflow at high level is the following:
  or between PATCH versions of the same MINOR. That is, you cannot skip MINOR versions when you upgrade.
  For example, you can upgrade from 1.y to 1.y+1, but not from 1.y to 1.y+2.

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Determine which version to upgrade to

@@ -148,7 +149,7 @@ Find the latest stable 1.18 version:
 {{< note >}}
 `kubeadm upgrade` also automatically renews the certificates that it manages on this node.
 To opt-out of certificate renewal the flag `--certificate-renewal=false` can be used.
-For more information see the [certificate management guide](/docs/tasks/administer-cluster/kubeadmkubeadm-certs).
+For more information see the [certificate management guide](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs).
 {{</ note >}}

 -  Choose a version to upgrade to, and run the appropriate command. For example:
@@ -295,6 +296,7 @@ Upgrade the kubelet and kubectl on all control plane nodes:
 Restart the kubelet

 ```shell
+sudo systemctl daemon-reload
 sudo systemctl restart kubelet
 ```

@@ -373,6 +375,7 @@ without compromising the minimum required capacity for running your workloads.
 -  Restart the kubelet

    ```shell
+    sudo systemctl daemon-reload
    sudo systemctl restart kubelet
    ```

@@ -395,7 +398,7 @@ kubectl get nodes

 The `STATUS` column should show `Ready` for all your nodes, and the version number should be updated.

-{{% /capture %}}
+

 ## Recovering from a failure state

@@ -441,4 +444,4 @@ and post-upgrade manifest file for a certain component, a backup file for it wil
 `kubeadm upgrade node` does the following on worker nodes:

 - Fetches the kubeadm `ClusterConfiguration` from the cluster.
- Upgrades the kubelet configuration for this node.
+- Upgrades the kubelet configuration for this node.
@@ -1,29 +1,30 @@
 ---
 title: Upgrading Windows nodes
 min-kubernetes-server-version: 1.17
-content_template: templates/task
+content_type: task
 weight: 40
 ---

-{{% capture overview %}}
+<!-- overview -->

 {{< feature-state for_k8s_version="v1.18" state="beta" >}}

 This page explains how to upgrade a Windows node [created with kubeadm](/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes).

-{{% /capture %}}


-{{% capture prerequisites %}} 
+
+## {{% heading "prerequisites" %}}
+ 
 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
 * Familiarize yourself with [the process for upgrading the rest of your kubeadm
 cluster](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade). You will want to
 upgrade the control plane nodes before upgrading your Windows nodes.

-{{% /capture %}}


-{{% capture steps %}}
+
+<!-- steps -->

 ## Upgrading worker nodes

@@ -90,4 +91,4 @@ again replacing {{< param "fullversion" >}} with your desired version:
    ```


-{{% /capture %}}
+
@@ -3,10 +3,10 @@ reviewers:
 - mtaufen
 - dawnchen
 title: Set Kubelet parameters via a config file
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 {{< feature-state for_k8s_version="v1.10" state="beta" >}}

 A subset of the Kubelet's configuration parameters may be
@@ -16,15 +16,16 @@ This functionality is considered beta in v1.10.
 Providing parameters via a config file is the recommended approach because
 it simplifies node deployment and configuration management.

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 - A v1.10 or higher Kubelet binary must be installed for beta functionality.

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Create the config file

@@ -67,9 +68,9 @@ If `--config` is provided and the values are not specified via the command line,
 defaults for the `KubeletConfiguration` version apply.
 In the above example, this version is `kubelet.config.k8s.io/v1beta1`.

-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->

 ## Relationship to Dynamic Kubelet Config

@@ -77,6 +78,6 @@ If you are using the [Dynamic Kubelet Configuration](/docs/tasks/administer-clus
 feature, the combination of configuration provided via `--config` and any flags which override these values
 is considered the default "last known good" configuration by the automatic rollback mechanism.

-{{% /capture %}}
+


@@ -1,9 +1,9 @@
 ---
 title: Limit Storage Consumption
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->

 This example demonstrates an easy way to limit the amount of storage consumed in a namespace.

@@ -11,15 +11,16 @@ The following resources are used in the demonstration: [ResourceQuota](/docs/con
 [LimitRange](/docs/tasks/administer-cluster/memory-default-namespace/),
 and [PersistentVolumeClaim](/docs/concepts/storage/persistent-volumes/).

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 * {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->
 ## Scenario: Limiting Storage Consumption

 The cluster-admin is operating a cluster on behalf of a user population and the admin wants to control
@@ -77,9 +78,9 @@ spec:
    requests.storage: "5Gi"
 ```

-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->

 ## Summary

@@ -87,6 +88,6 @@ A limit range can put a ceiling on how much storage is requested while a resourc
 consumed by a namespace through claim counts and cumulative storage capacity. The allows a cluster-admin to plan their
 cluster's storage budget without risk of any one project going over their allotment.

-{{% /capture %}}
+


@@ -1,11 +1,11 @@
 ---
 title: Configure Minimum and Maximum CPU Constraints for a Namespace
-content_template: templates/task
+content_type: task
 weight: 40
 ---


-{{% capture overview %}}
+<!-- overview -->

 This page shows how to set minimum and maximum values for the CPU resources used by Containers
 and Pods in a namespace. You specify minimum and maximum CPU values in a
@@ -13,19 +13,20 @@ and Pods in a namespace. You specify minimum and maximum CPU values in a
 object. If a Pod does not meet the constraints imposed by the LimitRange, it cannot be created
 in the namespace.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

 Your cluster must have at least 1 CPU available for use to run the task examples.

-{{% /capture %}}


-{{% capture steps %}}
+
+<!-- steps -->

 ## Create a namespace

@@ -239,9 +240,10 @@ Delete your namespace:
 kubectl delete namespace constraints-cpu-example
 ```

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 ### For cluster administrators

@@ -266,7 +268,7 @@ kubectl delete namespace constraints-cpu-example
 * [Configure Quality of Service for Pods](/docs/tasks/configure-pod-container/quality-service-pod/)


-{{% /capture %}}
+



@@ -1,10 +1,10 @@
 ---
 title: Configure Default CPU Requests and Limits for a Namespace
-content_template: templates/task
+content_type: task
 weight: 20
 ---

-{{% capture overview %}}
+<!-- overview -->

 This page shows how to configure default CPU requests and limits for a namespace.
 A Kubernetes cluster can be divided into namespaces. If a Container is created in a namespace
@@ -12,14 +12,15 @@ that has a default CPU limit, and the Container does not specify its own CPU lim
 the Container is assigned the default CPU limit. Kubernetes assigns a default CPU request
 under certain conditions that are explained later in this topic.

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Create a namespace

@@ -163,9 +164,10 @@ Delete your namespace:
 kubectl delete namespace default-cpu-example
 ```

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 ### For cluster administrators

@@ -189,6 +191,6 @@ kubectl delete namespace default-cpu-example

 * [Configure Quality of Service for Pods](/docs/tasks/configure-pod-container/quality-service-pod/)

-{{% /capture %}}
+


@@ -1,11 +1,11 @@
 ---
 title: Configure Minimum and Maximum Memory Constraints for a Namespace
-content_template: templates/task
+content_type: task
 weight: 30
 ---


-{{% capture overview %}}
+<!-- overview -->

 This page shows how to set minimum and maximum values for memory used by Containers
 running in a namespace. You specify minimum and maximum memory values in a
@@ -13,19 +13,20 @@ running in a namespace. You specify minimum and maximum memory values in a
 object. If a Pod does not meet the constraints imposed by the LimitRange,
 it cannot be created in the namespace.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

 Each node in your cluster must have at least 1 GiB of memory.

-{{% /capture %}}


-{{% capture steps %}}
+
+<!-- steps -->

 ## Create a namespace

@@ -239,9 +240,10 @@ Delete your namespace:
 kubectl delete namespace constraints-mem-example
 ```

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 ### For cluster administrators

@@ -265,7 +267,7 @@ kubectl delete namespace constraints-mem-example

 * [Configure Quality of Service for Pods](/docs/tasks/configure-pod-container/quality-service-pod/)

-{{% /capture %}}
+



@@ -1,27 +1,28 @@
 ---
 title: Configure Default Memory Requests and Limits for a Namespace
-content_template: templates/task
+content_type: task
 weight: 10
 ---

-{{% capture overview %}}
+<!-- overview -->

 This page shows how to configure default memory requests and limits for a namespace.
 If a Container is created in a namespace that has a default memory limit, and the Container
 does not specify its own memory limit, then the Container is assigned the default memory limit.
 Kubernetes assigns a default memory request under certain conditions that are explained later in this topic.

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

 Each node in your cluster must have at least 2 GiB of memory.

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Create a namespace

@@ -170,9 +171,10 @@ Delete your namespace:
 kubectl delete namespace default-mem-example
 ```

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 ### For cluster administrators

@@ -196,6 +198,6 @@ kubectl delete namespace default-mem-example

 * [Configure Quality of Service for Pods](/docs/tasks/configure-pod-container/quality-service-pod/)

-{{% /capture %}}
+


@@ -1,30 +1,31 @@
 ---
 title: Configure Memory and CPU Quotas for a Namespace
-content_template: templates/task
+content_type: task
 weight: 50
 ---


-{{% capture overview %}}
+<!-- overview -->

 This page shows how to set quotas for the total amount memory and CPU that
 can be used by all Containers running in a namespace. You specify quotas in a
 [ResourceQuota](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#resourcequota-v1-core)
 object.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

 Each node in your cluster must have at least 1 GiB of memory.

-{{% /capture %}}


-{{% capture steps %}}
+
+<!-- steps -->

 ## Create a namespace

@@ -146,9 +147,10 @@ Delete your namespace:
 kubectl delete namespace quota-mem-cpu-example
 ```

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 ### For cluster administrators

@@ -172,7 +174,7 @@ kubectl delete namespace quota-mem-cpu-example

 * [Configure Quality of Service for Pods](/docs/tasks/configure-pod-container/quality-service-pod/)

-{{% /capture %}}
+



@@ -1,28 +1,29 @@
 ---
 title: Configure a Pod Quota for a Namespace
-content_template: templates/task
+content_type: task
 weight: 60
 ---


-{{% capture overview %}}
+<!-- overview -->

 This page shows how to set a quota for the total number of Pods that can run
 in a namespace. You specify quotas in a
 [ResourceQuota](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#resourcequota-v1-core)
 object.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}


-{{% capture steps %}}
+
+<!-- steps -->

 ## Create a namespace

@@ -107,9 +108,10 @@ Delete your namespace:
 kubectl delete namespace quota-pod-example
 ```

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 ### For cluster administrators

@@ -133,7 +135,7 @@ kubectl delete namespace quota-pod-example

 * [Configure Quality of Service for Pods](/docs/tasks/configure-pod-container/quality-service-pod/)

-{{% /capture %}}
+



@@ -3,10 +3,10 @@ reviewers:
 - derekwaynecarr
 - janetkuo
 title: Namespaces Walkthrough
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 Kubernetes {{< glossary_tooltip text="namespaces" term_id="namespace" >}}
 help different projects, teams, or customers to share a Kubernetes cluster.

@@ -19,16 +19,17 @@ Use of multiple namespaces is optional.

 This example demonstrates how to use Kubernetes namespaces to subdivide your cluster.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Prerequisites

@@ -242,7 +243,7 @@ snowflake    2/2     2            2           2m
 ```

 ```shell
-kubectl get pods -l run=snowflake
+kubectl get pods -l app=snowflake
 ```
 ```
 NAME                         READY     STATUS    RESTARTS   AGE
@@ -278,7 +279,7 @@ cattle       5/5     5            5           10s
 ```

 ```shell
-kubectl get pods -l run=cattle
+kubectl get pods -l app=cattle
 ```
 ```
 NAME                      READY     STATUS    RESTARTS   AGE
@@ -294,4 +295,4 @@ At this point, it should be clear that the resources users create in one namespa
 As the policy support in Kubernetes evolves, we will extend this scenario to show how you can provide different
 authorization rules for each namespace.

-{{% /capture %}}
+
@@ -3,19 +3,20 @@ reviewers:
 - derekwaynecarr
 - janetkuo
 title: Share a Cluster with Namespaces
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to view, work in, and delete {{< glossary_tooltip text="namespaces" term_id="namespace" >}}. The page also shows how to use Kubernetes namespaces to subdivide your cluster.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+
 * Have an [existing Kubernetes cluster](/docs/setup/).
 * Have a basic understanding of Kubernetes _[Pods](/docs/concepts/workloads/pods/pod/)_, _[Services](/docs/concepts/services-networking/service/)_, and _[Deployments](/docs/concepts/workloads/controllers/deployment/)_.
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Viewing namespaces

@@ -201,7 +202,7 @@ This delete is asynchronous, so for a time you will see the namespace in the `Te
    snowflake    2/2     2            2           2m
    ```
    ```shell
-    kubectl get pods -l run=snowflake -n=development
+    kubectl get pods -l app=snowflake -n=development
    ```
    ```
    NAME                         READY     STATUS    RESTARTS   AGE
@@ -223,7 +224,8 @@ This delete is asynchronous, so for a time you will see the namespace in the `Te
    Production likes to run cattle, so let's create some cattle pods.

    ```shell
-    kubectl run cattle --image=k8s.gcr.io/serve_hostname --replicas=5 -n=production
+    kubectl create deployment cattle --image=k8s.gcr.io/serve_hostname -n=production
+    kubectl scale deployment cattle --replicas=5 -n=production

    kubectl get deployment -n=production
    ```
@@ -233,7 +235,7 @@ This delete is asynchronous, so for a time you will see the namespace in the `Te
    ```

    ```shell
-    kubectl get pods -l run=cattle -n=production
+    kubectl get pods -l app=cattle -n=production
    ```
    ```
    NAME                      READY     STATUS    RESTARTS   AGE
@@ -249,9 +251,9 @@ At this point, it should be clear that the resources users create in one namespa
 As the policy support in Kubernetes evolves, we will extend this scenario to show how you can provide different
 authorization rules for each namespace.

-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->

 ## Understanding the motivation for using namespaces

@@ -301,12 +303,13 @@ is local to a namespace.  This is useful for using the same configuration across
 multiple namespaces such as Development, Staging and Production.  If you want to reach
 across namespaces, you need to use the fully qualified domain name (FQDN).

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+
 * Learn more about [setting the namespace preference](/docs/concepts/overview/working-with-objects/namespaces/#setting-the-namespace-preference).
 * Learn more about [setting the namespace for a request](/docs/concepts/overview/working-with-objects/namespaces/#setting-the-namespace-for-a-request)
 * See [namespaces design](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/architecture/namespaces.md).
-{{% /capture %}}
+


@@ -2,19 +2,20 @@
 reviewers:
 - caseydavenport
 title: Use Calico for NetworkPolicy
-content_template: templates/task
+content_type: task
 weight: 10
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows a couple of quick ways to create a Calico cluster on Kubernetes.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+
 Decide whether you want to deploy a [cloud](#creating-a-calico-cluster-with-google-kubernetes-engine-gke) or [local](#creating-a-local-calico-cluster-with-kubeadm) cluster.
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->
 ## Creating a Calico cluster with Google Kubernetes Engine (GKE)

 **Prerequisite**: [gcloud](https://cloud.google.com/sdk/docs/quickstarts).
@@ -44,10 +45,11 @@ Decide whether you want to deploy a [cloud](#creating-a-calico-cluster-with-goog
 To get a local single-host Calico cluster in fifteen minutes using kubeadm, refer to the 
 [Calico Quickstart](https://docs.projectcalico.org/latest/getting-started/kubernetes/).

-{{% /capture %}}


-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+
 Once your cluster is running, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy.
-{{% /capture %}}
+

@@ -3,23 +3,24 @@ reviewers:
 - danwent
 - aanm
 title: Use Cilium for NetworkPolicy
-content_template: templates/task
+content_type: task
 weight: 20
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to use Cilium for NetworkPolicy.

 For background on Cilium, read the [Introduction to Cilium](https://docs.cilium.io/en/stable/intro).
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->
 ## Deploying Cilium on Minikube for Basic Testing

 To get familiar with Cilium easily you can follow the
@@ -50,7 +51,7 @@ For minikube you can deploy this simple ''all-in-one'' YAML file that includes
 DaemonSet configurations for Cilium as well as appropriate RBAC settings:

 ```shell
-kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.6/install/kubernetes/quick-install.yaml
+kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.8/install/kubernetes/quick-install.yaml
 ```
 ```
 configmap/cilium-config created
@@ -75,9 +76,9 @@ For detailed instructions around deploying Cilium for production, see:
 This documentation includes detailed requirements, instructions and example
 production DaemonSet files.

-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->
 ##  Understanding Cilium components

 Deploying a cluster with Cilium adds Pods to the `kube-system` namespace. To see
@@ -98,14 +99,15 @@ cilium-6rxbd    1/1     Running   0          1m
 A `cilium` Pod runs on each node in your cluster and enforces network policy
 on the traffic to/from Pods on that node using Linux BPF.

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+
 Once your cluster is running, you can follow the
 [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/)
 to try out Kubernetes NetworkPolicy with Cilium.
 Have fun, and if you have questions, contact us using the
 [Cilium Slack Channel](https://cilium.herokuapp.com/).
-{{% /capture %}}
+


@@ -2,25 +2,27 @@
 reviewers:
 - murali-reddy
 title: Use Kube-router for NetworkPolicy
-content_template: templates/task
+content_type: task
 weight: 30
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to use [Kube-router](https://github.com/cloudnativelabs/kube-router) for NetworkPolicy.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+
 You need to have a Kubernetes cluster running. If you do not already have a cluster, you can create one by using any of the cluster installers like Kops, Bootkube, Kubeadm etc.
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->
 ## Installing Kube-router addon
 The Kube-router Addon comes with a Network Policy Controller that watches Kubernetes API server for any NetworkPolicy and pods updated and configures iptables rules and ipsets to allow or block traffic as directed by the policies. Please follow the [trying Kube-router with cluster installers](https://www.kube-router.io/docs/user-guide/#try-kube-router-with-cluster-installers) guide to install Kube-router addon.
-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+
 Once you have installed the Kube-router addon, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy.
-{{% /capture %}}
+


@@ -2,23 +2,24 @@
 reviewers:
 - chrismarino
 title: Romana for NetworkPolicy
-content_template: templates/task
+content_type: task
 weight: 40
 ---

-{{% capture overview %}}
+<!-- overview -->

 This page shows how to use Romana for NetworkPolicy.

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 Complete steps 1, 2, and 3 of the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/).

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Installing Romana with kubeadm

@@ -32,12 +33,13 @@ To apply network policies use one of the following:
    * [Example of Romana network policy](https://github.com/romana/core/blob/master/doc/policy.md).
 * The NetworkPolicy API.

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 Once you have installed Romana, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy.

-{{% /capture %}}
+


@@ -2,23 +2,24 @@
 reviewers:
 - bboreham
 title: Weave Net for NetworkPolicy
-content_template: templates/task
+content_type: task
 weight: 50
 ---

-{{% capture overview %}}
+<!-- overview -->

 This page shows how to use Weave Net for NetworkPolicy.

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 You need to have a Kubernetes cluster. Follow the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/) to bootstrap one.

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Install the Weave Net addon

@@ -48,12 +49,13 @@ weave-net-pmw8w                         2/2       Running   0          9d

 Each Node has a weave Pod, and all Pods are `Running` and `2/2 READY`. (`2/2` means that each Pod has `weave` and `weave-npc`.)

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 Once you have installed the Weave Net addon, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy. If you have any question, contact us at [#weave-community on Slack or Weave User Group](https://github.com/weaveworks/weave#getting-help).

-{{% /capture %}}
+


@@ -4,21 +4,22 @@ reviewers:
 - zihongz
 - sftim
 title: Using NodeLocal DNSCache in Kubernetes clusters
-content_template: templates/task
+content_type: task
 ---
-
-{{% capture overview %}}
+ 
+<!-- overview -->
 {{< feature-state for_k8s_version="v1.18" state="stable" >}}
 This page provides an overview of NodeLocal DNSCache feature in Kubernetes.
-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
-{{% /capture %}}

- {{% capture steps %}}
+
+ <!-- steps -->

 ## Introduction

@@ -88,4 +89,4 @@ This feature can be enabled using the following steps:
 Once enabled, node-local-dns Pods will run in the kube-system namespace on each of the cluster nodes. This Pod runs [CoreDNS](https://github.com/coredns/coredns) in cache mode, so all CoreDNS metrics exposed by the different plugins will be available on a per-node basis.

 You can disable this feature by removing the DaemonSet, using `kubectl delete -f <manifest>` . You should also revert any changes you made to the kubelet configuration.
- {{% /capture %}}
+ 
@@ -4,10 +4,10 @@ reviewers:
 - vishh
 - timstclair
 title: Configure Out of Resource Handling
-content_template: templates/concept
+content_type: concept
 ---

-{{% capture overview %}}
+<!-- overview -->

 This page explains how to configure out of resource handling with `kubelet`.

@@ -16,10 +16,10 @@ are low. This is especially important when dealing with incompressible
 compute resources, such as memory or disk space. If such resources are exhausted,
 nodes become unstable.

-{{% /capture %}}


-{{% capture body %}}
+
+<!-- body -->

 ## Eviction Policy

@@ -372,4 +372,4 @@ to prevent system OOMs, and promote eviction of workloads so cluster state can r
 The Pod eviction may evict more Pods than needed due to stats collection timing gap. This can be mitigated by adding
 the ability to get root container stats on an on-demand basis [(https://github.com/google/cadvisor/issues/1247)](https://github.com/google/cadvisor/issues/1247) in the future.

-{{% /capture %}}
+
@@ -1,10 +1,10 @@
 ---
 title: Configure Quotas for API Objects
-content_template: templates/task
+content_type: task
 ---


-{{% capture overview %}}
+<!-- overview -->

 This page shows how to configure quotas for API objects, including
 PersistentVolumeClaims and Services. A quota restricts the number of
@@ -13,17 +13,18 @@ You specify quotas in a
 [ResourceQuota](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#resourcequota-v1-core)
 object.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}


-{{% capture steps %}}
+
+<!-- steps -->

 ## Create a namespace

@@ -140,9 +141,10 @@ Delete your namespace:
 kubectl delete namespace quota-object-example
 ```

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 ### For cluster administrators

@@ -167,7 +169,7 @@ kubectl delete namespace quota-object-example
 * [Configure Quality of Service for Pods](/docs/tasks/configure-pod-container/quality-service-pod/)


-{{% /capture %}}
+



@@ -3,11 +3,11 @@ reviewers:
 - mtaufen
 - dawnchen
 title: Reconfigure a Node's Kubelet in a Live Cluster
-content_template: templates/task
+content_type: task
 min-kubernetes-server-version: v1.11
 ---

-{{% capture overview %}}
+<!-- overview -->
 {{< feature-state for_k8s_version="v1.11" state="beta" >}}

 [Dynamic Kubelet Configuration](https://github.com/kubernetes/enhancements/issues/281)
@@ -25,9 +25,10 @@ of nodes before rolling them out cluster-wide. Advice on configuring specific
 fields is available in the inline `KubeletConfiguration`
 [type documentation](https://github.com/kubernetes/kubernetes/blob/release-1.11/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go).
 {{< /warning >}}
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+
 You need to have a Kubernetes cluster.
 You also need kubectl v1.11 or higher, configured to communicate with your cluster.
 {{< version-check >}}
@@ -43,9 +44,9 @@ because there are manual alternatives.

 For each node that you're reconfiguring, you must set the kubelet
 `--dynamic-config-dir` flag to a writable directory.
-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Reconfiguring the kubelet on a running node in your cluster

@@ -71,7 +72,7 @@ will receive default values appropriate to the configuration version
 (e.g. `kubelet.config.k8s.io/v1beta1`), unless overridden by flags.

 The status of the Node's kubelet configuration is reported via
-`Node.Spec.Status.Config`. Once you have updated a Node to use the new
+`Node.Status.Config`. Once you have updated a Node to use the new
 ConfigMap, you can observe this status to confirm that the Node is using the
 intended configuration.

@@ -311,9 +312,9 @@ empty, since all config sources have been reset to `nil`, which indicates that
 the local default config is `assigned`, `active`, and `lastKnownGood`, and no
 error is reported.

-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->
 ## `kubectl patch` example

 You can change a Node's configSource using several different mechanisms.
@@ -374,9 +375,9 @@ internal failure, see Kubelet log for details | The kubelet encountered some int

 {{< /table >}}

-{{% /capture %}}
-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+
 - For more information on configuring the kubelet via a configuration file, see
 [Set kubelet parameters via a config file](/docs/tasks/administer-cluster/kubelet-config-file).
 - See the reference documentation for [`NodeConfigSource`](https://kubernetes.io/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#nodeconfigsource-v1-core)
-{{% /capture %}}
@@ -4,11 +4,11 @@ reviewers:
 - derekwaynecarr
 - dashpole
 title: Reserve Compute Resources for System Daemons
-content_template: templates/task
+content_type: task
 min-kubernetes-server-version: 1.8
 ---

-{{% capture overview %}}
+<!-- overview -->

 Kubernetes nodes can be scheduled to `Capacity`. Pods can consume all the
 available capacity on a node by default. This is an issue because nodes
@@ -22,19 +22,20 @@ compute resources for system daemons. Kubernetes recommends cluster
 administrators to configure `Node Allocatable` based on their workload density
 on each node.

-{{% /capture %}}


-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
 Your Kubernetes server must be at or later than version 1.17 to use
 the kubelet command line option `--reserved-cpus` to set an
 [explicitly reserved CPU list](#explicitly-reserved-cpu-list).

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Node Allocatable

@@ -226,9 +227,9 @@ more features are added. Over time, kubernetes project will attempt to bring
 down utilization of node system daemons, but that is not a priority as of now.
 So expect a drop in `Allocatable` capacity in future releases.

-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->

 ## Example Scenario

@@ -251,4 +252,3 @@ If `kube-reserved` and/or `system-reserved` is not enforced and system daemons
 exceed their reservation, `kubelet` evicts pods whenever the overall node memory
 usage is higher than `31.5Gi` or `storage` is greater than `90Gi`

-{{% /capture %}}
@@ -4,10 +4,10 @@ reviewers:
 - thockin
 - wlan0
 title: Cloud Controller Manager Administration
-content_template: templates/concept
+content_type: concept
 ---

-{{% capture overview %}}
+<!-- overview -->

 {{< feature-state state="beta" for_k8s_version="v1.11" >}}

@@ -15,10 +15,10 @@ Since cloud providers develop and release at a different pace compared to the Ku

 The `cloud-controller-manager` can be linked to any cloud provider that satisfies [cloudprovider.Interface](https://github.com/kubernetes/cloud-provider/blob/master/cloud.go). For backwards compatibility, the [cloud-controller-manager](https://github.com/kubernetes/kubernetes/tree/master/cmd/cloud-controller-manager) provided in the core Kubernetes project uses the same cloud libraries as `kube-controller-manager`. Cloud providers already supported in Kubernetes core are expected to use the in-tree cloud-controller-manager to transition out of Kubernetes core.

-{{% /capture %}}


-{{% capture body %}}
+
+<!-- body -->

 ## Administration

@@ -82,9 +82,10 @@ A good example of this is the TLS bootstrapping feature in the Kubelet. TLS boot

 As this initiative evolves, changes will be made to address these issues in upcoming releases.

-{{% /capture %}}
-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 To build and develop your own cloud controller manager, read [Developing Cloud Controller Manager](/docs/tasks/administer-cluster/developing-cloud-controller-manager/).

-{{% /capture %}}
+
@@ -5,14 +5,15 @@ reviewers:
 - foxish
 - kow3ns
 title: Safely Drain a Node while Respecting the PodDisruptionBudget
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 This page shows how to safely drain a node, respecting the PodDisruptionBudget you have defined.
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 This task assumes that you have met the following prerequisites:

@@ -24,9 +25,9 @@ This task assumes that you have met the following prerequisites:
     and [Configured PodDisruptionBudgets](/docs/tasks/run-application/configure-pdb/) for
     applications that need them.

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Use `kubectl drain` to remove a node from service

@@ -151,13 +152,14 @@ In this case, there are two potential solutions:
 Kubernetes does not specify what the behavior should be in this case; it is up to the
 application owners and cluster owners to establish an agreement on behavior in these cases.

-{{% /capture %}}

-{{% capture whatsnext %}}
+
+## {{% heading "whatsnext" %}}
+

 * Follow steps to protect your application by [configuring a Pod Disruption Budget](/docs/tasks/run-application/configure-pdb/).
 * Learn more about [maintenance on a node](/docs/tasks/administer-cluster/cluster-management/#maintenance-on-a-node).

-{{% /capture %}}
+


@@ -5,23 +5,24 @@ reviewers:
 - ericchiang
 - destijl
 title: Securing a Cluster
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->

 This document covers topics related to protecting a cluster from accidental or malicious access
 and provides recommendations on overall security.

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 * {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Controlling access to the Kubernetes API

@@ -254,6 +255,6 @@ Join the [kubernetes-announce](https://groups.google.com/forum/#!forum/kubernete
 group for emails about security announcements. See the [security reporting](/security/)
 page for more on how to report vulnerabilities.

-{{% /capture %}}
+


@@ -2,25 +2,26 @@
 title: Using sysctls in a Kubernetes Cluster
 reviewers:
 - sttts
-content_template: templates/task
+content_type: task
 ---

-{{% capture overview %}}
+<!-- overview -->
 {{< feature-state for_k8s_version="v1.12" state="beta" >}}

 This document describes how to configure and use kernel parameters within a
 Kubernetes cluster using the {{< glossary_tooltip term_id="sysctl" >}}
 interface.

-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## Listing all Sysctl Parameters

@@ -140,9 +141,9 @@ spec:
      value: "65536"
  ...
 ```
-{{% /capture %}}

-{{% capture discussion %}}
+
+<!-- discussion -->

 {{< warning >}}
 Due to their nature of being _unsafe_, the use of _unsafe_ sysctls
@@ -188,9 +189,9 @@ Do not configure these two fields such that there is overlap, meaning that a
 given sysctl is both allowed and forbidden.

 {{< warning >}}
-If you whitelist unsafe sysctls via the `allowedUnsafeSysctls` field
+If you allow unsafe sysctls via the `allowedUnsafeSysctls` field
 in a PodSecurityPolicy, any pod using such a sysctl will fail to start
-if the sysctl is not whitelisted via the `--allowed-unsafe-sysctls` kubelet
+if the sysctl is not allowed via the `--allowed-unsafe-sysctls` kubelet
 flag as well on that node.
 {{< /warning >}}

@@ -210,4 +211,4 @@ spec:
 ...
 ```

-{{% /capture %}}
+
@@ -8,11 +8,11 @@ reviewers:
 - nolancon
 - bg-chun

-content_template: templates/task
+content_type: task
 min-kubernetes-server-version: v1.18
 ---

-{{% capture overview %}}
+<!-- overview -->

 {{< feature-state state="beta" for_k8s_version="v1.18" >}}

@@ -22,15 +22,16 @@ In order to extract the best performance, optimizations related to CPU isolation

 _Topology Manager_ is a Kubelet component that aims to co-ordinate the set of components that are responsible for these optimizations.
 
-{{% /capture %}}

-{{% capture prerequisites %}}
+
+## {{% heading "prerequisites" %}}
+

 {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}

-{{% /capture %}}

-{{% capture steps %}}
+
+<!-- steps -->

 ## How Topology Manager Works

@@ -216,4 +217,4 @@ Using this information the Topology Manager calculates the optimal hint for the

 3. The Device Manager and the CPU Manager are the only components to adopt the Topology Manager's HintProvider interface. This means that NUMA alignment can only be achieved for resources managed by the CPU Manager and the Device Manager. Memory or Hugepages are not considered by the Topology Manager for NUMA alignment.

-{{% /capture %}}
+