diff --git a/content/zh/docs/tasks/_index.md b/content/zh/docs/tasks/_index.md
index dff8e43aa2..4924d17d49 100644
--- a/content/zh/docs/tasks/_index.md
+++ b/content/zh/docs/tasks/_index.md
@@ -21,3 +21,10 @@ single thing, typically by giving a short sequence of steps.
 Kubernetes 文档这一部分包含的一些页面展示如何去完成单个任务。
 每个任务页面是一般通过给出若干步骤展示如何执行完成某事。
 
+<!--
+If you would like to write a task page, see
+[Creating a Documentation Pull Request](/docs/contribute/new-content/open-a-pr/).
+-->
+如果你希望编写一个任务页面，参考
+[创建一个文档拉取请求](/zh/docs/contribute/new-content/open-a-pr/)。
+
diff --git a/content/zh/docs/tasks/access-application-cluster/configure-access-multiple-clusters.md b/content/zh/docs/tasks/access-application-cluster/configure-access-multiple-clusters.md
index f1553da086..f8399bf098 100644
--- a/content/zh/docs/tasks/access-application-cluster/configure-access-multiple-clusters.md
+++ b/content/zh/docs/tasks/access-application-cluster/configure-access-multiple-clusters.md
@@ -203,7 +203,7 @@ users:
 
 <!--
 The `fake-ca-file`, `fake-cert-file` and `fake-key-file` above are the placeholders
-for the pathnames of the certificate files. You need change these to the actual pathnames
+for the pathnames of the certificate files. You need to change these to the actual pathnames
 of certificate files in your environment.
 
 Sometimes you may want to use Base64-encoded data embedded here instead of separate
diff --git a/content/zh/docs/tasks/access-application-cluster/connecting-frontend-backend.md b/content/zh/docs/tasks/access-application-cluster/connecting-frontend-backend.md
index f66cd77124..3fa7626c88 100644
--- a/content/zh/docs/tasks/access-application-cluster/connecting-frontend-backend.md
+++ b/content/zh/docs/tasks/access-application-cluster/connecting-frontend-backend.md
@@ -228,10 +228,10 @@ so that you can change the configuration more easily.
 <!--
 ## Interact with the frontend Service
 
-Once you’ve created a Service of type LoadBalancer, you can use this
+Once you've created a Service of type LoadBalancer, you can use this
 command to find the external IP:
 -->
-### 与前端 Service 交互
+### 与前端 Service 交互   {#interact-with-the-frontend-service}
 
 一旦你创建了 LoadBalancer 类型的 Service，你可以使用这条命令查看外部 IP：
 
diff --git a/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md b/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md
index 5add4e7920..4694ac5dbc 100644
--- a/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md
+++ b/content/zh/docs/tasks/access-application-cluster/ingress-minikube.md
@@ -61,9 +61,9 @@ This page shows you how to set up a simple Ingress which routes requests to Serv
 1. 为了启用 NGINIX Ingress 控制器，可以运行下面的命令：
 
 
-    ```shell
-    minikube addons enable ingress
-    ```
+   ```shell
+   minikube addons enable ingress
+   ```
 
 <!--
 1. Verify that the NGINX Ingress controller is running
@@ -75,11 +75,13 @@ This page shows you how to set up a simple Ingress which routes requests to Serv
    ```
 
    <!-- This can take up to a minute. -->
-   {{< note >}}这一操作可供需要近一分钟时间。{{< /note >}}
+   {{< note >}}
+   这一操作可能需要近一分钟时间。
+   {{< /note >}}
 
    输出：
 
-   ```shell
+   ```
    NAME                                        READY     STATUS    RESTARTS   AGE
    default-http-backend-59868b7dd6-xb8tq       1/1       Running   0          1m
    kube-addon-manager-minikube                 1/1       Running   0          3m
@@ -197,7 +199,7 @@ The following file is an Ingress resource that sends traffic to your Service via
 
 1. 根据下面的 YAML 创建文件 `example-ingress.yaml`：
 
-  {{< codenew file="service/networking/example-ingress.yaml" >}}
+   {{< codenew file="service/networking/example-ingress.yaml" >}}
 
 <!--
 1. Create the Ingress resource by running the following command:
@@ -211,9 +213,10 @@ The following file is an Ingress resource that sends traffic to your Service via
    <!-- Output: -->
    输出：
 
-   ```shell
+   ```
    ingress.networking.k8s.io/example-ingress created
    ```
+
 <!--
 1. Verify the IP address is set:
 -->
@@ -224,9 +227,11 @@ The following file is an Ingress resource that sends traffic to your Service via
    ```
 
    <!-- This can take a couple of minutes. -->
-   {{< note >}}此操作可能需要几分钟时间。{{< /note >}}
+   {{< note >}}
+   此操作可能需要几分钟时间。
+   {{< /note >}}
 
-   ```shell
+   ```
    NAME              CLASS    HOSTS              ADDRESS        PORTS   AGE
    example-ingress   <none>   hello-world.info   172.17.0.15    80      38s
    ```
@@ -262,7 +267,7 @@ The following file is an Ingress resource that sends traffic to your Service via
    <!-- Output: -->
    输出：
 
-   ```shell
+   ```
    Hello, world!
    Version: 1.0.0
    Hostname: web-55b8c6998d-8k564
@@ -290,7 +295,7 @@ The following file is an Ingress resource that sends traffic to your Service via
    <!-- Output: -->
    输出：
 
-   ```shell
+   ```
    deployment.apps/web2 created
    ```
 
@@ -306,7 +311,7 @@ The following file is an Ingress resource that sends traffic to your Service via
    <!-- Output:  -->
    输出：
 
-   ```shell
+   ```
    service/web2 exposed
    ```
 
@@ -321,13 +326,13 @@ The following file is an Ingress resource that sends traffic to your Service via
 
 
    ```yaml
-     - path: /v2
-       pathType: Prefix
-       backend:
-         service:
-           name: web2
-           port:
-             number: 8080
+   - path: /v2
+     pathType: Prefix
+     backend:
+       service:
+         name: web2
+         port:
+           number: 8080
    ```
 
 <!--
@@ -342,7 +347,7 @@ The following file is an Ingress resource that sends traffic to your Service via
    <!-- Output: -->
    输出：
 
-   ```shell
+   ```
    ingress.networking/example-ingress configured
    ```
 
diff --git a/content/zh/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md b/content/zh/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md
index 3663e9827a..06791739d7 100644
--- a/content/zh/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md
+++ b/content/zh/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md
@@ -5,27 +5,22 @@ weight: 40
 ---
 
 <!--
----
 title: Use Port Forwarding to Access Applications in a Cluster
 content_type: task
 weight: 40
----
 -->
 
 <!-- overview -->
-
 <!--
 This page shows how to use `kubectl port-forward` to connect to a Redis
 server running in a Kubernetes cluster. This type of connection can be useful
 for database debugging.
 -->
-本文展示如何使用 `kubectl port-forward` 连接到在 Kubernetes 集群中运行的 Redis 服务。这种类型的连接对数据库调试很有用。
-
-
+本文展示如何使用 `kubectl port-forward` 连接到在 Kubernetes 集群中
+运行的 Redis 服务。这种类型的连接对数据库调试很有用。
 
 ## {{% heading "prerequisites" %}}
 
-
 * {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
 
 <!--
@@ -33,9 +28,6 @@ for database debugging.
 -->
 * 安装 [redis-cli](http://redis.io/topics/rediscli)。
 
-
-
-
 <!-- steps -->
 
 <!--
@@ -47,172 +39,206 @@ for database debugging.
 
 1. 创建一个 Redis deployment：
 
-        kubectl apply -f https://k8s.io/examples/application/guestbook/redis-master-deployment.yaml
+   ```shell
+   kubectl apply -f https://k8s.io/examples/application/guestbook/redis-master-deployment.yaml
+   ```
 
-<!--
-    The output of a successful command verifies that the deployment was created:
--->
-    查看输出是否成功，以验证是否成功创建 deployment：
+   <!--
+   The output of a successful command verifies that the deployment was created:
+   -->
+   查看输出是否成功，以验证是否成功创建 deployment：
 
-        deployment.apps/redis-master created
-    
-<!--
-    View the pod status to check that it is ready:
--->
-    查看 pod 状态，检查其是否准备就绪：
+   ```
+   deployment.apps/redis-master created
+   ```
 
-        kubectl get pods
-    
-<!--
-    The output displays the pod created:
--->
-    输出显示创建的 pod：
+   <!--
+   View the pod status to check that it is ready:
+   -->
+   查看 pod 状态，检查其是否准备就绪：
 
-        NAME                            READY     STATUS    RESTARTS   AGE
-        redis-master-765d459796-258hz   1/1       Running   0          50s
+   ```shell
+   kubectl get pods
+   ```
 
-<!--
-    View the deployment status:
--->
-    查看 deployment 状态：
+   <!--
+   The output displays the pod created:
+   -->
+   输出显示创建的 pod：
 
-        kubectl get deployment
+   ```
+   NAME                            READY     STATUS    RESTARTS   AGE
+   redis-master-765d459796-258hz   1/1       Running   0          50s
+   ```
 
-<!--
-    The output displays that the deployment was created:
--->
-    输出显示创建的 deployment：
+   <!--
+   View the deployment status:
+   -->
+   查看 deployment 状态：
 
-        NAME         DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
-        redis-master 1         1         1            1           55s
+   ```shell
+   kubectl get deployment
+   ```
 
-<!--
-    View the replicaset status using:
--->
-    查看 replicaset 状态：
+   <!--
+   The output displays that the deployment was created:
+   -->
+   输出显示创建的 deployment：
 
-        kubectl get rs
+   ```
+   NAME         DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
+   redis-master 1         1         1            1           55s
+   ```
 
-<!--
-    The output displays that the replicaset was created:
--->
-    输出显示创建的 replicaset：
+   <!--
+   View the replicaset status using:
+   -->
+   查看 replicaset 状态：
 
-        NAME                      DESIRED   CURRENT   READY     AGE
-        redis-master-765d459796   1         1         1         1m
+   ```shell
+   kubectl get rs
+   ```
+
+   <!--
+   The output displays that the replicaset was created:
+   -->
+   输出显示创建的 replicaset：
+
+   ```
+   NAME                      DESIRED   CURRENT   READY     AGE
+   redis-master-765d459796   1         1         1         1m
+   ```
 
 <!--
 2. Create a Redis service:
 -->
 2. 创建一个 Redis 服务：
 
-       kubectl apply -f https://k8s.io/examples/application/guestbook/redis-master-service.yaml
+   ```shell
+   kubectl apply -f https://k8s.io/examples/application/guestbook/redis-master-service.yaml
+   ```
 
-<!--
-    The output of a successful command verifies that the service was created:
--->
-    查看输出是否成功，以验证是否成功创建 service：
+   <!--
+   The output of a successful command verifies that the service was created:
+   -->
+   查看输出是否成功，以验证是否成功创建 service：
 
-        service/redis-master created
+   ```
+   service/redis-master created
+   ```
 
-<!--
-    Check the service created:
--->
-    检查 service 是否创建：
+   <!--
+   Check the service created:
+   -->
+   检查 service 是否创建：
 
-       kubectl get svc | grep redis
+   ```shell
+   kubectl get svc | grep redis
+   ```
 
- <!--   
-    The output displays the service created:
--->
-    输出显示创建的 service：
-        NAME           TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)    AGE
-        redis-master   ClusterIP   10.0.0.213   <none>        6379/TCP   27s
+   <!--   
+   The output displays the service created:
+   -->
+   输出显示创建的 service：
+
+   ```
+   NAME           TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)    AGE
+   redis-master   ClusterIP   10.0.0.213   <none>        6379/TCP   27s
+   ```
 
 <!--
 3. Verify that the Redis server is running in the pod and listening on port 6379:
 -->
 3. 验证 Redis 服务是否运行在 pod 中并且监听 6379 端口：
 
+   ```shell
+   kubectl get pods redis-master-765d459796-258hz \
+     --template='{{(index (index .spec.containers 0).ports 0).containerPort}}{{"\n"}}'
+   ```
+   <!--
+   The output displays the port:
+   -->
+   输出应该显示端口：
 
-       kubectl get pods redis-master-765d459796-258hz --template='{{(index (index .spec.containers 0).ports 0).containerPort}}{{"\n"}}'
-
-<!--
-    The output displays the port:
--->
-    输出应该显示端口：
-
-        6379
-
+   ```
+   6379
+   ```
 
 <!--
 ## Forward a local port to a port on the pod
 
-1.  `kubectl port-forward` allows using resource name, such as a pod name, to select a matching pod to port forward to since Kubernetes v1.10.
+1. `kubectl port-forward` allows using resource name, such as a pod name, to select a matching pod to port forward to since Kubernetes v1.10.
 -->
 ## 转发一个本地端口到 pod 端口
 
-1. 从 Kubernetes v1.10 开始，`kubectl port-forward` 允许使用资源名称（例如 pod 名称）来选择匹配的 pod 来进行端口转发。
+1. 从 Kubernetes v1.10 开始，`kubectl port-forward` 允许使用资源名称
+   （例如 pod 名称）来选择匹配的 pod 来进行端口转发。
 
-        kubectl port-forward redis-master-765d459796-258hz 7000:6379 
+   ```shell
+   kubectl port-forward redis-master-765d459796-258hz 7000:6379 
+   ```
+   <!--
+   which is the same as
+   -->
+   这相当于
+
+   ```shell
+   kubectl port-forward pods/redis-master-765d459796-258hz 7000:6379
+   ```
+
+   <!-- or -->
+   或者
+
+   ```shell
+   kubectl port-forward deployment/redis-master 7000:6379 
+   ```
+
+   <!-- or -->
+   或者
+
+   ```shell
+   kubectl port-forward rs/redis-master 7000:6379
+   ```
+
+   <!-- or -->
+   或者
+
+   ```
+   kubectl port-forward svc/redis-master 7000:redis
+   ```
+
+   <!--
+   Any of the above commands works. The output is similar to this:
+   -->
+   以上所有命令都应该有效。输出应该类似于：
+
+   ```
+   I0710 14:43:38.274550    3655 portforward.go:225] Forwarding from 127.0.0.1:7000 -> 6379
+   I0710 14:43:38.274797    3655 portforward.go:225] Forwarding from [::1]:7000 -> 6379
+   ```
 
 <!--
-    which is the same as
--->
-    这相当于
-
-        kubectl port-forward pods/redis-master-765d459796-258hz 7000:6379
-
-<!--
-    or
--->
-    或者
-
-        kubectl port-forward deployment/redis-master 7000:6379 
-
-<!--
-    or
--->
-    或者
-
-        kubectl port-forward rs/redis-master 7000:6379
-
-<!--
-    or
--->
-    或者
-
-        kubectl port-forward svc/redis-master 7000:6379
-
-<!--
-    Any of the above commands works. The output is similar to this:
--->
-    以上所有命令都应该有效。输出应该类似于：
-
-        I0710 14:43:38.274550    3655 portforward.go:225] Forwarding from 127.0.0.1:7000 -> 6379
-        I0710 14:43:38.274797    3655 portforward.go:225] Forwarding from [::1]:7000 -> 6379
-
-<!--
-2.  Start the Redis command line interface:
+2. Start the Redis command line interface:
 -->
 2. 启动 Redis 命令行接口：
 
-        redis-cli -p 7000
+   ```shell
+   redis-cli -p 7000
+   ```
 
 <!--
 3.  At the Redis command line prompt, enter the `ping` command:
 -->
 3. 在 Redis 命令行提示符下，输入 `ping` 命令：
 
-        127.0.0.1:7000>ping
-
-<!--
-    A successful ping request returns PONG.
--->
-    成功的 ping 请求应该返回 PONG。
-
-
+   ```
+   127.0.0.1:7000>ping
+   ```
 
+   <!--
+   A successful ping request returns PONG.
+   -->
+   成功的 ping 请求应该返回 PONG。
 
 <!-- discussion -->
 
@@ -223,9 +249,10 @@ Connections made to local port 7000 are forwarded to port 6379 of the pod that
 is running the Redis server. With this connection in place you can use your
 local workstation to debug the database that is running in the pod.
 -->
-## 讨论
+## 讨论  {#discussion}
 
-与本地 7000 端口建立的连接将转发到运行 Redis 服务器的 pod 的 6379 端口。通过此连接，您可以使用本地工作站来调试在 pod 中运行的数据库。
+与本地 7000 端口建立的连接将转发到运行 Redis 服务器的 pod 的 6379 端口。
+通过此连接，您可以使用本地工作站来调试在 pod 中运行的数据库。
 
 <!--
 Due to known limitations, port forward today only works for TCP protocol.
@@ -234,19 +261,14 @@ The support to UDP protocol is being tracked in
 -->
 {{< warning >}}
 由于已知的限制，目前的端口转发仅适用于 TCP 协议。
-在 [issue 47862](https://github.com/kubernetes/kubernetes/issues/47862) 中正在跟踪对 UDP 协议的支持。
+在 [issue 47862](https://github.com/kubernetes/kubernetes/issues/47862)
+中正在跟踪对 UDP 协议的支持。
 {{< /warning >}}
 
-
-
-
 ## {{% heading "whatsnext" %}}
 
 <!--
 Learn more about [kubectl port-forward](/docs/reference/generated/kubectl/kubectl-commands/#port-forward).
 -->
-学习更多关于 [kubectl port-forward](/docs/reference/generated/kubectl/kubectl-commands/#port-forward)。
-
-
-
+进一步了解 [kubectl port-forward](/docs/reference/generated/kubectl/kubectl-commands/#port-forward)。
 
diff --git a/content/zh/docs/tasks/administer-cluster/access-cluster-api.md b/content/zh/docs/tasks/administer-cluster/access-cluster-api.md
index e66ebb3e3a..30ab9330a5 100644
--- a/content/zh/docs/tasks/administer-cluster/access-cluster-api.md
+++ b/content/zh/docs/tasks/administer-cluster/access-cluster-api.md
@@ -225,14 +225,13 @@ certificate.
 <!--
 On some clusters, the API server does not require authentication; it may serve
 on localhost, or be protected by a firewall. There is not a standard
-for this. [Configuring Access to the API](/docs/reference/access-authn-authz/controlling-access/)
-describes how a cluster admin can configure this. Such approaches may conflict
-with future high-availability support.
+for this. [Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access)
+describes how you can configure this as a cluster administrator.
 -->
 在一些集群中，API 服务器不需要身份认证；它运行在本地，或由防火墙保护着。
 对此并没有一个标准。
-[配置对 API 的访问](/zh/docs/reference/access-authn-authz/controlling-access/)
-阐述了一个集群管理员如何对此进行配置。这种方法可能与未来的高可用性支持发生冲突。
+[配置对 API 的访问](/zh/docs/concepts/security/controlling-access/)
+讲解了作为集群管理员可如何对此进行配置。
 
 <!--
 ### Programmatic access to the API
diff --git a/content/zh/docs/tasks/administer-cluster/dns-debugging-resolution.md b/content/zh/docs/tasks/administer-cluster/dns-debugging-resolution.md
index 423c8e5d8f..2603ecc49c 100644
--- a/content/zh/docs/tasks/administer-cluster/dns-debugging-resolution.md
+++ b/content/zh/docs/tasks/administer-cluster/dns-debugging-resolution.md
@@ -129,7 +129,7 @@ add-on or with associated Services:
 -->
 下列错误表示 CoreDNS （或 kube-dns）插件或者相关服务出现了问题：
 
-```
+```shell
 kubectl exec -i -t dnsutils -- nslookup kubernetes.default
 ```
 
@@ -156,7 +156,7 @@ nslookup: can't resolve 'kubernetes.default'
 
 Use the `kubectl get pods` command to verify that the DNS pod is running.
 -->
-### 检查 DNS Pod 是否运行
+### 检查 DNS Pod 是否运行   {#check-if-the-dns-pod-is-running}
 
 使用 `kubectl get pods` 命令来验证 DNS Pod 是否运行。
 
@@ -192,7 +192,7 @@ will have to deploy it manually.
 
 Use `kubectl logs` command to see logs for the DNS containers.
 -->
-### 检查 DNS Pod 里的错误
+### 检查 DNS Pod 里的错误    {#check-for-errors-in-the-dns-pod}
 
 使用 `kubectl logs` 命令来查看 DNS 容器的日志信息。
 
@@ -224,7 +224,7 @@ See if there are any suspicious or unexpected messages in the logs.
 
 Verify that the DNS service is up by using the `kubectl get service` command.
 -->
-### 检查是否启用了 DNS 服务
+### 检查是否启用了 DNS 服务   {#is-dns-service-up}
 
 使用 `kubectl get service` 命令来检查 DNS 服务是否已经启用。
 
@@ -263,13 +263,14 @@ more information.
 You can verify that DNS endpoints are exposed by using the `kubectl get endpoints`
 command.
 -->
-### DNS 的末端公开了吗？
+### DNS 的端点公开了吗？    {#are-dns-endpoints-exposed}
 
-你可以使用 `kubectl get endpoints` 命令来验证 DNS 的末端是否公开了。
+你可以使用 `kubectl get endpoints` 命令来验证 DNS 的端点是否公开了。
 
 ```shell
 kubectl get ep kube-dns --namespace=kube-system
 ```
+
 ```
 NAME       ENDPOINTS                       AGE
 kube-dns   10.180.3.17:53,10.180.3.17:53    1h
@@ -283,8 +284,8 @@ For additional Kubernetes DNS examples, see the
 [cluster-dns examples](https://github.com/kubernetes/examples/tree/master/staging/cluster-dns)
 in the Kubernetes GitHub repository.
 -->
-如果你没看到对应的末端，请阅读
-[调试服务](/zh/docs/tasks/debug-application-cluster/debug-service/)的末端部分。
+如果你没看到对应的端点，请阅读
+[调试服务](/zh/docs/tasks/debug-application-cluster/debug-service/)的端点部分。
 
 若需要了解更多的 Kubernetes DNS 例子，请在 Kubernetes GitHub 仓库里查看
 [cluster-dns 示例](https://github.com/kubernetes/examples/tree/master/staging/cluster-dns)。 
@@ -295,12 +296,12 @@ in the Kubernetes GitHub repository.
 You can verify if queries are being received by CoreDNS by adding the `log` plugin to the CoreDNS configuration (aka Corefile).
 The CoreDNS Corefile is held in a ConfigMap named `coredns`. To edit it, use the command ...
 -->
-### DNS 查询有被接收或者执行吗？
+### DNS 查询有被接收或者执行吗？   {#are-dns-queries-bing-received-processed}
 
 你可以通过给 CoreDNS 的配置文件（也叫 Corefile）添加 `log` 插件来检查查询是否被正确接收。
 CoreDNS 的 Corefile 被保存在一个叫 `coredns` 的 ConfigMap 里，使用下列命令来编辑它：
 
-```
+```shell
 kubectl -n kube-system edit configmap coredns
 ```
 
@@ -309,7 +310,7 @@ Then add `log` in the Corefile section per the example below.
 -->
 然后按下面的例子给 Corefile 添加 `log`。
 
-```
+```yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
diff --git a/content/zh/docs/tasks/administer-cluster/ip-masq-agent.md b/content/zh/docs/tasks/administer-cluster/ip-masq-agent.md
index e6c126ea1e..e4d8bc8297 100644
--- a/content/zh/docs/tasks/administer-cluster/ip-masq-agent.md
+++ b/content/zh/docs/tasks/administer-cluster/ip-masq-agent.md
@@ -26,7 +26,10 @@ This page shows how to configure and enable the ip-masq-agent.
 <!--
 The ip-masq-agent configures iptables rules to hide a pod's IP address behind the cluster node's IP address. This is typically done when sending traffic to destinations outside the cluster's pod [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) range.
 -->
-ip-masq-agent 配置 iptables 规则以隐藏位于集群节点 IP 地址后面的 pod 的 IP 地址。 这通常在将流量发送到集群的 pod [CIDR](https://zh.wikipedia.org/wiki/%E6%97%A0%E7%B1%BB%E5%88%AB%E5%9F%9F%E9%97%B4%E8%B7%AF%E7%94%B1) 范围之外的目的地时使用。
+ip-masq-agent 配置 iptables 规则以隐藏位于集群节点 IP 地址后面的 Pod 的 IP 地址。
+这通常在将流量发送到集群的 Pod
+[CIDR](https://zh.wikipedia.org/wiki/%E6%97%A0%E7%B1%BB%E5%88%AB%E5%9F%9F%E9%97%B4%E8%B7%AF%E7%94%B1)
+范围之外的目的地时使用。
 
 <!--
 ### **Key Terms**
@@ -34,47 +37,56 @@ ip-masq-agent 配置 iptables 规则以隐藏位于集群节点 IP 地址后面
 ### **关键术语**
 
 <!--
-*   **NAT (Network Address Translation)**
-    Is a method of remapping one IP address to another by modifying either the source and/or destination address information in the IP header.  Typically performed by a device doing IP routing.
+* **NAT (Network Address Translation)**
+  Is a method of remapping one IP address to another by modifying either the source and/or destination address information in the IP header.  Typically performed by a device doing IP routing.
 -->
-*   **NAT (网络地址解析)**
-    是一种通过修改 IP 地址头中的源和/或目标地址信息将一个 IP 地址重新映射到另一个 IP 地址的方法。通常由执行 IP 路由的设备执行。
+* **NAT (网络地址转译)**
+  是一种通过修改 IP 地址头中的源和/或目标地址信息将一个 IP 地址重新映射
+  到另一个 IP 地址的方法。通常由执行 IP 路由的设备执行。
 
 <!--
-*   **Masquerading**
-    A form of NAT that is typically used to perform a many to one address translation, where multiple source IP addresses are masked behind a single address, which is typically the device doing the IP routing. In Kubernetes this is the Node's IP address.
+* **Masquerading**
+  A form of NAT that is typically used to perform a many to one address translation, where multiple source IP addresses are masked behind a single address, which is typically the device doing the IP routing. In Kubernetes this is the Node's IP address.
 -->    
-*   **伪装**
-    NAT 的一种形式，通常用于执行多对一地址转换，其中多个源 IP 地址被隐藏在单个地址后面，该地址通常是执行 IP 路由的设备。在 Kubernetes 中，这是节点的 IP 地址。
+* **伪装**
+  NAT 的一种形式，通常用于执行多对一地址转换，其中多个源 IP 地址被隐藏在
+  单个地址后面，该地址通常是执行 IP 路由的设备。在 Kubernetes 中，
+  这是节点的 IP 地址。
 
 <!--
-*   **CIDR (Classless Inter-Domain Routing)**
-    Based on the variable-length subnet masking, allows specifying arbitrary-length prefixes. CIDR introduced a new method of representation for IP addresses, now commonly known as **CIDR notation**, in which an address or routing prefix is written with a suffix indicating the number of bits of the prefix, such as 192.168.2.0/24.
+* **CIDR (Classless Inter-Domain Routing)**
+  Based on the variable-length subnet masking, allows specifying arbitrary-length prefixes. CIDR introduced a new method of representation for IP addresses, now commonly known as **CIDR notation**, in which an address or routing prefix is written with a suffix indicating the number of bits of the prefix, such as 192.168.2.0/24.
 -->
-*   **CIDR (无类别域间路由)**
-    基于可变长度子网掩码，允许指定任意长度的前缀。CIDR 引入了一种新的 IP 地址表示方法，现在通常称为**CIDR表示法**，其中地址或路由前缀后添加一个后缀，用来表示前缀的位数，例如 192.168.2.0/24。
+* **CIDR (无类别域间路由)**
+  基于可变长度子网掩码，允许指定任意长度的前缀。
+  CIDR 引入了一种新的 IP 地址表示方法，现在通常称为**CIDR表示法**，
+  其中地址或路由前缀后添加一个后缀，用来表示前缀的位数，例如 192.168.2.0/24。
 
 <!--
-*   **Link Local**
-    A link-local address is a network address that is valid only for communications within the network segment or the broadcast domain that the host is connected to. Link-local addresses for IPv4 are defined in the address block 169.254.0.0/16 in CIDR notation.
+* **Link Local**
+  A link-local address is a network address that is valid only for communications within the network segment or the broadcast domain that the host is connected to. Link-local addresses for IPv4 are defined in the address block 169.254.0.0/16 in CIDR notation.
 -->
-*   **本地链路**
-    本地链路是仅对网段或主机所连接的广播域内的通信有效的网络地址。IPv4的本地链路地址在 CIDR 表示法的地址块 169.254.0.0/16 中定义。
+* **本地链路**
+  本地链路是仅对网段或主机所连接的广播域内的通信有效的网络地址。
+  IPv4 的本地链路地址在 CIDR 表示法的地址块 169.254.0.0/16 中定义。
 
 <!--
 The ip-masq-agent configures iptables rules to handle masquerading node/pod IP addresses when sending traffic to destinations outside the cluster node's IP and the Cluster IP range.  This essentially hides pod IP addresses behind the cluster node's IP address.  In some environments, traffic to "external" addresses must come from a known machine address. For example, in Google Cloud, any traffic to the internet must come from a VM's IP.  When containers are used, as in Google Kubernetes Engine, the Pod IP will be rejected for egress. To avoid this, we must hide the Pod IP behind the VM's own IP address - generally known as "masquerade". By default, the agent is configured to treat the three private IP ranges specified by [RFC 1918](https://tools.ietf.org/html/rfc1918) as non-masquerade [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing).  These ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The agent will also treat link-local (169.254.0.0/16) as a non-masquerade CIDR by default.  The agent is configured to reload its configuration from the location */etc/config/ip-masq-agent* every 60 seconds, which is also configurable.
 -->
 ip-masq-agent 配置 iptables 规则，以便在将流量发送到集群节点的 IP 和集群 IP 范围之外的目标时
-处理伪装节点/Pod 的 IP 地址。这基本上隐藏了集群节点 IP 地址后面的 Pod IP 地址。
+处理伪装节点或 Pod 的 IP 地址。这本质上隐藏了集群节点 IP 地址后面的 Pod IP 地址。
 在某些环境中，去往“外部”地址的流量必须从已知的机器地址发出。
 例如，在 Google Cloud 中，任何到互联网的流量都必须来自 VM 的 IP。
 使用容器时，如 Google Kubernetes Engine，从 Pod IP 发出的流量将被拒绝出站。
 为了避免这种情况，我们必须将 Pod IP 隐藏在 VM 自己的 IP 地址后面 - 通常称为“伪装”。
-默认情况下，代理配置为将[RFC 1918](https://tools.ietf.org/html/rfc1918)指定的三个私有
-IP 范围视为非伪装 [CIDR](https://zh.wikipedia.org/wiki/%E6%97%A0%E7%B1%BB%E5%88%AB%E5%9F%9F%E9%97%B4%E8%B7%AF%E7%94%B1)。
+默认情况下，代理配置为将
+[RFC 1918](https://tools.ietf.org/html/rfc1918)
+指定的三个私有 IP 范围视为非伪装
+[CIDR](https://zh.wikipedia.org/wiki/%E6%97%A0%E7%B1%BB%E5%88%AB%E5%9F%9F%E9%97%B4%E8%B7%AF%E7%94%B1)。
 这些范围是 10.0.0.0/8,172.16.0.0/12 和 192.168.0.0/16。
 默认情况下，代理还将链路本地地址（169.254.0.0/16）视为非伪装 CIDR。
-代理程序配置为每隔 60 秒从 */etc/config/ip-masq-agent* 重新加载其配置，这也是可修改的。
+代理程序配置为每隔 60 秒从 */etc/config/ip-masq-agent* 重新加载其配置，
+这也是可修改的。
 
 ![masq/non-masq example](/images/docs/ip-masq.png)
 
@@ -86,17 +98,21 @@ The agent configuration file must be written in YAML or JSON syntax, and may con
 <!--
 *   **nonMasqueradeCIDRs:** A list of strings in [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation that specify the non-masquerade ranges.
 -->
-*   **nonMasqueradeCIDRs:** [CIDR](https://zh.wikipedia.org/wiki/%E6%97%A0%E7%B1%BB%E5%88%AB%E5%9F%9F%E9%97%B4%E8%B7%AF%E7%94%B1) 表示法中的字符串列表，用于指定不需伪装的地址范围。
+* **nonMasqueradeCIDRs:**
+  [CIDR](https://zh.wikipedia.org/wiki/%E6%97%A0%E7%B1%BB%E5%88%AB%E5%9F%9F%E9%97%B4%E8%B7%AF%E7%94%B1)
+  表示法中的字符串列表，用于指定不需伪装的地址范围。
 
 <!--
 *   **masqLinkLocal:** A Boolean (true / false) which indicates whether to masquerade traffic to the link local prefix 169.254.0.0/16. False by default.
 -->
-*   **masqLinkLocal:** 布尔值 (true / false)，表示是否将流量伪装到本地链路前缀 169.254.0.0/16。默认为 false。
+* **masqLinkLocal:** 布尔值 (true / false)，表示是否将流量伪装到
+  本地链路前缀 169.254.0.0/16。默认为 false。
 
 <!--
 *   **resyncInterval:** An interval at which the agent attempts to reload config from disk. e.g. '30s' where 's' is seconds, 'ms' is milliseconds etc...
 -->
-*   **resyncInterval:** 代理尝试从磁盘重新加载配置的时间间隔。 例如 '30s'，其中 's' 是秒，'ms' 是毫秒等...
+* **resyncInterval:** 代理尝试从磁盘重新加载配置的时间间隔。
+  例如 '30s'，其中 's' 是秒，'ms' 是毫秒等...
 
 <!--
 Traffic to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16) ranges will NOT be masqueraded. Any other traffic (assumed to be internet) will be masqueraded.  An example of a local destination from a pod could be its Node's IP address as well as another node's address or one of the IP addresses in Cluster's IP range.   Any other traffic will be masqueraded by default.  The below entries show the default set of rules that are applied by the ip-masq-agent:
@@ -106,7 +122,6 @@ Traffic to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16) ranges will NOT be masq
 Pod 访问本地目的地的例子，可以是其节点的 IP 地址、另一节点的地址或集群的 IP 地址范围内的一个 IP 地址。
 默认情况下，任何其他流量都将伪装。以下条目展示了 ip-masq-agent 的默认使用的规则：
 
-<!--
 ```
 iptables -t nat -L IP-MASQ-AGENT
 RETURN     all  --  anywhere             169.254.0.0/16       /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL
@@ -115,16 +130,6 @@ RETURN     all  --  anywhere             172.16.0.0/12        /* ip-masq-agent:
 RETURN     all  --  anywhere             192.168.0.0/16       /* ip-masq-agent: cluster-local traffic should not be subject to MASQUERADE */ ADDRTYPE match dst-type !LOCAL
 MASQUERADE  all  --  anywhere             anywhere             /* ip-masq-agent: outbound traffic should be subject to MASQUERADE (this match must come after cluster-local CIDR matches) */ ADDRTYPE match dst-type !LOCAL
 
-```
--->
-```
-iptables -t nat -L IP-MASQ-AGENT
-RETURN     all  --  anywhere             169.254.0.0/16       /* ip-masq-agent: 集群本地流量不被 MASQUERADE 控制 */ ADDRTYPE match dst-type !LOCAL
-RETURN     all  --  anywhere             10.0.0.0/8           /* ip-masq-agent: 集群本地流量不被 MASQUERADE 控制 */ ADDRTYPE match dst-type !LOCAL
-RETURN     all  --  anywhere             172.16.0.0/12        /* ip-masq-agent: 集群本地流量不被 MASQUERADE 控制 */ ADDRTYPE match dst-type !LOCAL
-RETURN     all  --  anywhere             192.168.0.0/16       /* ip-masq-agent: 集群本地流量不被 MASQUERADE 控制 */ ADDRTYPE match dst-type !LOCAL
-MASQUERADE  all  --  anywhere             anywhere             /* ip-masq-agent: 出站流量应受 MASQUERADE 控制 (此规则必须在集群本地 CIDR 规则之后) */ ADDRTYPE match dst-type !LOCAL
-
 ```
 
 <!--
@@ -143,25 +148,26 @@ By default, in GCE/Google Kubernetes Engine starting with Kubernetes version 1.7
 To create an ip-masq-agent, run the following kubectl command:
 -->
 ## 创建 ip-masq-agent
+
 通过运行以下 kubectl 指令创建 ip-masq-agent:
 
-`
-kubectl apply -f https://raw.githubusercontent.com/kubernetes-incubator/ip-masq-agent/master/ip-masq-agent.yaml
-`
+```shell
+kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/ip-masq-agent/master/ip-masq-agent.yaml
+```
 
 <!--
 You must also apply the appropriate node label to any nodes in your cluster that you want the agent to run on.
 -->
 你必须同时将适当的节点标签应用于集群中希望代理运行的任何节点。
 
-`
+```shell
 kubectl label nodes my-node beta.kubernetes.io/masq-agent-ds-ready=true
-`
+```
 
 <!--
-More information can be found in the ip-masq-agent documentation [here](https://github.com/kubernetes-incubator/ip-masq-agent)
+More information can be found in the ip-masq-agent documentation [here](https://github.com/kubernetes-sigs/ip-masq-agent)
 -->
-更多信息可以通过 ip-masq-agent 文档 [这里](https://github.com/kubernetes-incubator/ip-masq-agent) 找到
+更多信息可以通过 ip-masq-agent 文档 [这里](https://github.com/kubernetes-sigs/ip-masq-agent) 找到。
 
 <!--
 In most cases, the default set of rules should be sufficient; however, if this is not the case for your cluster, you can create and apply a [ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap/) to customize the IP ranges that are affected.  For example, to allow only 10.0.0.0/8 to be considered by the ip-masq-agent, you can create the following [ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap/) in a file called "config".
@@ -169,14 +175,15 @@ In most cases, the default set of rules should be sufficient; however, if this i
 在大多数情况下，默认的规则集应该足够；但是，如果你的群集不是这种情况，则可以创建并应用
 [ConfigMap](/zh/docs/tasks/configure-pod-container/configure-pod-configmap/)
 来自定义受影响的 IP 范围。
-例如，要允许 ip-masq-agent 仅作用于 10.0.0.0/8，你可以一个名为 “config” 的文件中创建以下
+例如，要允许 ip-masq-agent 仅作用于 10.0.0.0/8，你可以在一个名为 “config” 的文件中创建以下
 [ConfigMap](/zh/docs/tasks/configure-pod-container/configure-pod-configmap/) 。
 
 {{< note >}}
 <!--
 It is important that the file is called config since, by default, that will be used as the key for lookup by the ip-masq-agent:
 -->
-重要的是，该文件之所以被称为 config，因为默认情况下，该文件将被用作 ip-masq-agent 查找的关键：
+重要的是，该文件之所以被称为 config，因为默认情况下，该文件将被用作
+ip-masq-agent 查找的主键：
 
 ```
 nonMasqueradeCIDRs:
@@ -202,7 +209,6 @@ After the resync interval has expired, you should see the iptables rules reflect
 为周期定期检查并应用于集群节点。
 重新同步间隔到期后，你应该看到你的更改在 iptables 规则中体现：
 
-<!--
 ```
 iptables -t nat -L IP-MASQ-AGENT
 Chain IP-MASQ-AGENT (1 references)
@@ -211,20 +217,13 @@ RETURN     all  --  anywhere             169.254.0.0/16       /* ip-masq-agent:
 RETURN     all  --  anywhere             10.0.0.0/8           /* ip-masq-agent: cluster-local
 MASQUERADE  all  --  anywhere             anywhere             /* ip-masq-agent: outbound traffic should be subject to MASQUERADE (this match must come after cluster-local CIDR matches) */ ADDRTYPE match dst-type !LOCAL
 ```
--->
-```
-iptables -t nat -L IP-MASQ-AGENT
-Chain IP-MASQ-AGENT (1 references)
-target     prot opt source               destination
-RETURN     all  --  anywhere             169.254.0.0/16       /* ip-masq-agent: 集群本地流量不被 MASQUERADE 控制 */ ADDRTYPE match dst-type !LOCAL
-RETURN     all  --  anywhere             10.0.0.0/8           /* ip-masq-agent: cluster-local
-MASQUERADE  all  --  anywhere             anywhere             /* ip-masq-agent: 出站流量应受 MASQUERADE 控制 (此规则必须在集群本地 CIDR 规则之后) */ ADDRTYPE match dst-type !LOCAL
-```
 
 <!--
 By default, the link local range (169.254.0.0/16) is also handled by the ip-masq agent, which sets up the appropriate iptables rules.  To have the ip-masq-agent ignore link local, you can set *masqLinkLocal*  to true in the config map.
 -->
-默认情况下，本地链路范围 (169.254.0.0/16) 也由 ip-masq agent 处理，该代理设置适当的 iptables 规则。 要使 ip-masq-agent 忽略本地链路，可以在配置映射中将 *masqLinkLocal* 设置为true。
+默认情况下，本地链路范围 (169.254.0.0/16) 也由 ip-masq agent 处理，
+该代理设置适当的 iptables 规则。 要使 ip-masq-agent 忽略本地链路，
+可以在配置映射中将 *masqLinkLocal* 设置为 true。
 
 ```
 nonMasqueradeCIDRs:
diff --git a/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md
index 5e3d098340..fb66b92b9b 100644
--- a/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md
+++ b/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md
@@ -15,9 +15,9 @@ content_type: task
 {{< feature-state for_k8s_version="v1.15" state="stable" >}}
 
 <!-- 
-Client certificates generated by [kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm/) expire after 1 year. This page explains how to manage certificate renewals with kubeadm. 
+Client certificates generated by [kubeadm](/docs/reference/setup-tools/kubeadm/) expire after 1 year. This page explains how to manage certificate renewals with kubeadm. 
 -->
-由 [kubeadm](/zh/docs/reference/setup-tools/kubeadm/kubeadm/) 生成的客户端证书在 1 年后到期。
+由 [kubeadm](/zh/docs/reference/setup-tools/kubeadm/) 生成的客户端证书在 1 年后到期。
 本页说明如何使用 kubeadm 管理证书续订。
 
 ## {{% heading "prerequisites" %}}
@@ -89,7 +89,7 @@ You can use the `check-expiration` subcommand to check certificate expiration.
 
 你可以使用 `check-expiration` 子命令来检查证书是否过期
 
-```
+```shell
 kubeadm alpha certs check-expiration
 ``` 
 
diff --git a/content/zh/docs/tasks/inject-data-application/distribute-credentials-secure.md b/content/zh/docs/tasks/inject-data-application/distribute-credentials-secure.md
index 6683178d1d..5d271d71dd 100644
--- a/content/zh/docs/tasks/inject-data-application/distribute-credentials-secure.md
+++ b/content/zh/docs/tasks/inject-data-application/distribute-credentials-secure.md
@@ -329,7 +329,7 @@ This functionality is available in Kubernetes v1.6 and later.
    ```
 
 <!--
-*  Use envFrom to define all of the Secret’s data as container environment variables. The key from the Secret becomes the environment variable name in the Pod.
+*  Use envFrom to define all of the Secret's data as container environment variables. The key from the Secret becomes the environment variable name in the Pod.
 -->
 *  使用 `envFrom` 来将 Secret 中的所有数据定义为环境变量。
    Secret 中的键名成为容器中的环境变量名：
diff --git a/content/zh/docs/tasks/inject-data-application/podpreset.md b/content/zh/docs/tasks/inject-data-application/podpreset.md
index 2765869e40..78237967e1 100644
--- a/content/zh/docs/tasks/inject-data-application/podpreset.md
+++ b/content/zh/docs/tasks/inject-data-application/podpreset.md
@@ -26,13 +26,13 @@ This page shows how to use PodPreset objects to inject information like {{< glos
 ## {{% heading "prerequisites" %}}
 
 <!--
-You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. If you do not already have a cluster, you can create one using [Minikube](/docs/setup/learning-environment/minikube/).
+You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. If you do not already have a cluster, you can create one using [Minikube](https://minikube.sigs.k8s.io/docs/).
 Make sure that you have [enabled PodPreset](/docs/concepts/workloads/pods/podpreset/#enable-pod-preset) in your cluster.
 -->
 你需要一个运行的 Kubernetes 集群以及配置好与集群通信的 kubectl 命令行工具。
-如果你还没有集群，可以使用 [Minikube](/zh/docs/setup/learning-environment/minikube/)
+如果你还没有集群，可以使用 [Minikube](https://minikube.sigs.k8s.io/docs/)
 安装一个。
-确保你已经在集群中[启用了 PodPreset](/docs/concepts/workloads/pods/podpreset/#enable-pod-preset)。
+确保你已经在集群中[启用了 PodPreset](/zh/docs/concepts/workloads/pods/podpreset/#enable-pod-preset)。
 
 <!--
 ## Use Pod presets to inject environment variables and volumes