convert include to array in _config.yml

prevent bot indexing
Merge branch 'master' of https://github.com/kubernetes/kubernetes.github.io into release-1.6
2017-07-24 16:15:28 -07:00 · 2017-07-24 11:16:47 -07:00 · 2017-06-29 16:04:20 -07:00 · 2017-06-29 15:58:48 -07:00 · 2017-06-28 23:27:17 -07:00 · 2017-06-28 22:08:36 -07:00
721 changed files with 23370 additions and 15022 deletions
@@ -1,3 +1,7 @@
+> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+> For 1.7 Features: set Milestone to `1.7` and Base Branch to `release-1.7`
+> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+>
 > NOTE: Please check the “Allow edits from maintainers” box below to allow 
 > reviewers fix problems on your patch and speed up the review process.
 > Please delete this note before submitting the pull request.
@@ -24,4 +24,3 @@ Session.vim
 tags

 kubernetes.github.io.iml
-_redirects
@@ -1,6 +1,6 @@
 language: go
 go:
-  - 1.7.3
+  - 1.8.1

 # Don't want default ./... here:
 install:
@@ -11,23 +11,9 @@ install:
 # (1) Fetch dependencies for us to run the tests in test/examples_test.go
 - go get -t -v k8s.io/kubernetes.github.io/test

-# The dependencies are complicated for test/examples_test.go
-# k8s.io/kubernetes/pkg is a dependency, which in turn depends on apimachinery
-# but we also have apimachinery directly as one of our dependencies, which causes a conflict.
-# Additionally, we get symlinks when we clone the directory. The below steps do the following:
-
-# (a) Replace the symlink with the actual dependencies from kubernetes/staging/src/
-# (b) copy all the vendored files to $GOPATH/src
- rm $GOPATH/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery
- rm $GOPATH/src/k8s.io/kubernetes/vendor/k8s.io/apiserver
- rm $GOPATH/src/k8s.io/kubernetes/vendor/k8s.io/client-go
- rm $GOPATH/src/k8s.io/kubernetes/vendor/k8s.io/sample-apiserver
- rm $GOPATH/src/k8s.io/kubernetes/vendor/k8s.io/kube-aggregator
- cp -r $GOPATH/src/k8s.io/kubernetes/vendor/* $GOPATH/src/
- rm -rf $GOPATH/src/k8s.io/kubernetes/vendor/*
- cp -r $GOPATH/src/k8s.io/kubernetes/staging/src/* $GOPATH/src/
- cp -r $GOPATH/src/k8s.io/apimachinery/vendor/* $GOPATH/src/
- rm -rf $GOPATH/src/k8s.io/apimachinery/vendor/*
+# Simplified deduplication of dependencies.
+- cp -L -R $GOPATH/src/k8s.io/kubernetes/vendor/ $GOPATH/src/
+- rm -r $GOPATH/src/k8s.io/kubernetes/vendor/

 # (2) Fetch md-check along with all its dependencies.
 - git clone --depth=50 --branch=master https://github.com/kubernetes/md-check $HOME/gopath/src/k8s.io/md-check
@@ -17,7 +17,7 @@ The [Kubernetes SIG Docs Discussion Group](https://groups.google.com/forum/#!for

 ### Style Guides and Templates

-Before submitting a pull request to create new content, please review the [Kubernetes.io style guide](http://kubernetes.io/docs/contribute/style-guide/) and follow the [instructions for using page templates](http://kubernetes.io/docs/contribute/page-templates/). 
+Before submitting a pull request to create new content, please review the [Kubernetes.io style guide](http://kubernetes.io/docs/home/contribute/style-guide/) and follow the [instructions for using page templates](http://kubernetes.io/docs/home/contribute/page-templates/). 


 ## Contributing to Documentation
@@ -33,4 +33,4 @@ Note that code issues should be filed against the main kubernetes repository, wh

 ### Submitting Documentation Pull Requests

-If you're fixing an issue in the existing documentation, you should submit a PR against the master branch.  Follow [these instructions to create a documentation pull request against the kubernetes.io repository](http://kubernetes.io/docs/contribute/create-pull-request/).
+If you're fixing an issue in the existing documentation, you should submit a PR against the master branch.  Follow [these instructions to create a documentation pull request against the kubernetes.io repository](http://kubernetes.io/docs/home/contribute/create-pull-request/).
@@ -1,4 +1,4 @@
-.PHONY: all build build-preview generate-redirects help serve
+.PHONY: all build build-preview help serve

 help: ## Show this help.
 	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
@@ -11,8 +11,5 @@ build: ## Build site with production settings and put deliverables in _site.
 build-preview: ## Build site with drafts and future posts enabled.
 	jekyll build --drafts --future

-generate-redirects: ## Generate a redirects file and copy it into the _site directory.
-	mkdir -p _site && REDIRECTS_PATH=_site/_redirects ruby redirects.rb
-
 serve: ## Boot the development server.
 	jekyll serve
@@ -7,11 +7,11 @@ You can click the **Fork** button in the upper-right area of the screen to creat
 For more information about contributing to the Kubernetes documentation, see:

 * [Contributing to the Kubernetes Documentation](http://kubernetes.io/editdocs/)
-* [Creating a Documentation Pull Request](http://kubernetes.io/docs/contribute/create-pull-request/)
-* [Writing a New Topic](http://kubernetes.io/docs/contribute/write-new-topic/)
-* [Staging Your Documentation Changes](http://kubernetes.io/docs/contribute/stage-documentation-changes/)
-* [Using Page Templates](http://kubernetes.io/docs/contribute/page-templates/)
-* [Documentation Style Guide](http://kubernetes.io/docs/contribute/style-guide/)
+* [Creating a Documentation Pull Request](http://kubernetes.io/docs/home/contribute/create-pull-request/)
+* [Writing a New Topic](http://kubernetes.io/docs/home/contribute/write-new-topic/)
+* [Staging Your Documentation Changes](http://kubernetes.io/docs/home/contribute/stage-documentation-changes/)
+* [Using Page Templates](http://kubernetes.io/docs/home/contribute/page-templates/)
+* [Documentation Style Guide](http://kubernetes.io/docs/home/contribute/style-guide/)

 ## Thank you!

@@ -1,5 +1,6 @@
 name: Kubernetes
 title: Kubernetes
+url: https://kubernetes.io
 description: Production-Grade Container Orchestration
 markdown: kramdown
 kramdown:
@@ -17,7 +18,8 @@ defaults:
    scope:
      path: ""
    values:
-      version: "v1.5.1"
+      fullversion: "v1.6.3"
+      version: "v1.6"
      githubbranch: "master"
      docsbranch: "master"
  -
@@ -36,19 +38,23 @@ gems:
  - jekyll-seo-tag
  - jekyll-include-cache

+include: [_headers]
+
 # SEO
 logo: /images/favicon.png
 twitter:
  username: kubernetesio

+# empty array for tabs
+emptyArray: []
+
 # Tables of contents, stored in the _data folder, that control the sidebar nav
 tocs:
  - docs-home
-  - guides
-  - tutorials
+  - setup
  - tasks
+  - tutorials
  - concepts
  - reference
-  - tools
  - samples
-  - support
+  - search
@@ -10,13 +10,21 @@ toc:
  - title: Working with Kubernetes Objects
    section:
    - docs/concepts/overview/working-with-objects/kubernetes-objects.md
+    - docs/concepts/overview/working-with-objects/names.md
+    - docs/concepts/overview/working-with-objects/namespaces.md
    - docs/concepts/overview/working-with-objects/labels.md
    - docs/concepts/overview/working-with-objects/annotations.md
  - docs/concepts/overview/kubernetes-api.md

+- title: Kubernetes Architecture
+  section:
+  - docs/concepts/architecture/nodes.md
+  - docs/concepts/architecture/master-node-communication.md
+
 - title: Containers
  section:
  - docs/concepts/containers/images.md
+  - docs/concepts/containers/container-environment-variables.md
  - docs/concepts/containers/container-lifecycle-hooks.md

 - title: Workloads
@@ -24,51 +32,59 @@ toc:
  - title: Pods
    section:
    - docs/concepts/workloads/pods/pod-overview.md
+    - docs/concepts/workloads/pods/pod.md
    - docs/concepts/workloads/pods/pod-lifecycle.md
    - docs/concepts/workloads/pods/init-containers.md
  - title: Controllers
    section:
+    - docs/concepts/workloads/controllers/replicaset.md
+    - docs/concepts/workloads/controllers/replicationcontroller.md
+    - docs/concepts/workloads/controllers/deployment.md
    - docs/concepts/workloads/controllers/statefulset.md
    - docs/concepts/workloads/controllers/petset.md
+    - docs/concepts/workloads/controllers/daemonset.md
    - docs/concepts/workloads/controllers/garbage-collection.md
-  - title: Jobs
-    section:
-    - docs/concepts/jobs/run-to-completion-finite-workloads.md
-
- title: Cluster Administration
-  section:
-  - docs/concepts/cluster-administration/manage-deployment.md
-  - docs/concepts/cluster-administration/networking.md
-  - docs/concepts/cluster-administration/network-plugins.md
-  - docs/concepts/cluster-administration/logging.md
-  - docs/concepts/cluster-administration/audit.md
-  - docs/concepts/cluster-administration/resource-usage-monitoring.md
-  - docs/concepts/cluster-administration/out-of-resource.md
-  - docs/concepts/cluster-administration/multiple-clusters.md
-  - docs/concepts/cluster-administration/federation.md
-  - docs/concepts/cluster-administration/federation-service-discovery.md
-  - docs/concepts/cluster-administration/guaranteed-scheduling-critical-addon-pods.md
-  - docs/concepts/cluster-administration/static-pod.md
-  - docs/concepts/cluster-administration/sysctl-cluster.md
-  - docs/concepts/cluster-administration/access-cluster.md
-  - docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig.md
-
- title: Storage
-  section:
-  - docs/concepts/storage/volumes.md
-
- title: Services, Load Balancing, and Networking
-  section:
-  - docs/concepts/services-networking/dns-pod-service.md
-  - docs/concepts/services-networking/connect-applications-service.md
+    - docs/concepts/workloads/controllers/jobs-run-to-completion.md
+    - docs/concepts/workloads/controllers/cron-jobs.md

 - title: Configuration
  section:
  - docs/concepts/configuration/overview.md
-  - docs/concepts/configuration/container-command-args.md
  - docs/concepts/configuration/manage-compute-resources-container.md
+  - docs/concepts/configuration/assign-pod-node.md
+  - docs/concepts/configuration/secret.md

- title: Policies
+- title: Services, Load Balancing, and Networking
  section:
-  - docs/concepts/policy/container-capabilities.md
-  - docs/concepts/policy/resource-quotas.md
+  - docs/concepts/services-networking/service.md
+  - docs/concepts/services-networking/dns-pod-service.md
+  - docs/concepts/services-networking/connect-applications-service.md
+  - docs/concepts/services-networking/ingress.md
+  - docs/concepts/services-networking/network-policies.md
+
+- title: Storage
+  section:
+  - docs/concepts/storage/volumes.md
+  - docs/concepts/storage/persistent-volumes.md
+  - title: Dynamic Provisioning
+    path: http://blog.kubernetes.io/2016/10/dynamic-provisioning-and-storage-in-kubernetes.html
+
+- title: Cluster Administration
+  section:
+  - docs/concepts/cluster-administration/cluster-administration-overview.md
+  - docs/concepts/cluster-administration/manage-deployment.md
+  - docs/concepts/cluster-administration/networking.md
+  - docs/concepts/cluster-administration/network-plugins.md
+  - docs/concepts/cluster-administration/logging.md
+  - docs/concepts/cluster-administration/kubelet-garbage-collection.md
+  - docs/concepts/cluster-administration/federation.md
+  - docs/concepts/cluster-administration/sysctl-cluster.md
+  - docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig.md
+  - docs/concepts/cluster-administration/master-node-communication.md
+  - docs/concepts/cluster-administration/proxies.md
+  - title: Policies
+    section:
+    - docs/concepts/policy/resource-quotas.md
+    - docs/concepts/policy/pod-security-policy.md
+
+
@@ -1,4 +1,23 @@
-bigheader: "Kubernetes Documentation"
+bigheader: "Documentation Home"
 abstract: "Documentation for using and learning about Kubernetes."
 toc:
- docs/index.md
+- docs/home/index.md
+
+- docs/home/index.md
+
+- title: Release Notes
+  path: https://git.k8s.io/kubernetes/CHANGELOG.md
+- title: Release Roadmap
+  path: https://github.com/kubernetes/kubernetes/milestones/
+
+- docs/tasks/debug-application-cluster/troubleshooting.md
+
+- title: Contributing to the Kubernetes Docs
+  section:
+  - editdocs.md
+  - docs/home/contribute/create-pull-request.md
+  - docs/home/contribute/write-new-topic.md
+  - docs/home/contribute/stage-documentation-changes.md
+  - docs/home/contribute/page-templates.md
+  - docs/home/contribute/review-issues.md
+  - docs/home/contribute/style-guide.md
@@ -1,10 +1,10 @@
 tocs:
 - docs-home
 - guides
- tutorials
+- setup
 - tasks
+- tutorials
 - concepts
 - reference
- tools
 - samples
 - support
@@ -1,223 +0,0 @@
-bigheader: "Guides"
-abstract: "How to get started, and accomplish tasks, using Kubernetes."
-toc:
- docs/user-guide/index.md
-
- docs/whatisk8s.md
-
- docs/user-guide/index.md
-
- title: Accessing the Cluster
-  section:
-  - docs/user-guide/prereqs.md
-  - docs/user-guide/accessing-the-cluster.md
-  - docs/user-guide/sharing-clusters.md
-  - docs/user-guide/kubeconfig-file.md
-
- docs/user-guide/ui.md
-
- title: Workload Deployment and Management
-  section:
-  - docs/user-guide/managing-deployments.md
-  - docs/user-guide/replication-controller/operations.md
-  - docs/user-guide/resizing-a-replication-controller.md
-  - docs/user-guide/rolling-updates.md
-  - docs/user-guide/update-demo/index.md
-  - docs/user-guide/configmap/index.md
-  - docs/user-guide/projected-volume/index.md
-  - docs/user-guide/horizontal-pod-autoscaling/walkthrough.md
-  - docs/user-guide/config-best-practices.md
-  - docs/user-guide/working-with-resources.md
-  - docs/user-guide/garbage-collection.md
-  - title: Using NetworkPolicy
-    section:
-    - docs/getting-started-guides/network-policy/walkthrough.md
-    - docs/getting-started-guides/network-policy/calico.md
-    - docs/getting-started-guides/network-policy/romana.md
-    - docs/getting-started-guides/network-policy/weave.md
-
- title: Batch Jobs
-  section:
-  - docs/user-guide/jobs.md
-  - docs/user-guide/jobs/expansions/index.md
-  - docs/user-guide/jobs/work-queue-1/index.md
-  - docs/user-guide/jobs/work-queue-2/index.md
-  - docs/user-guide/cron-jobs.md
-
- title: Service Discovery and Load Balancing
-  section:
-  - docs/user-guide/connecting-applications.md
-  - docs/user-guide/services/operations.md
-  - docs/user-guide/load-balancer.md
-  - docs/user-guide/services-firewalls.md
-  - docs/user-guide/federation/federated-services.md
-
- title: Containers and Pods
-  section:
-  - docs/user-guide/pods/multi-container.md
-  - docs/user-guide/pod-templates.md
-  - docs/user-guide/environment-guide/index.md
-  - docs/user-guide/compute-resources.md
-  - docs/user-guide/liveness/index.md
-  - docs/user-guide/container-environment.md
-  - docs/user-guide/node-selection/index.md
-  - docs/user-guide/petset/bootstrapping/index.md
-
- title: Monitoring, Logging, and Debugging Containers
-  section:
-  - docs/user-guide/monitoring.md
-  - title: Logging
-    section:
-    - docs/user-guide/logging/overview.md
-    - docs/user-guide/logging/stackdriver.md
-    - docs/user-guide/logging/elasticsearch.md
-  - docs/user-guide/connecting-to-applications-proxy.md
-  - docs/user-guide/connecting-to-applications-port-forward.md
-  - title: Using Explorer to Examine the Runtime Environment
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/explorer
-
- title: Creating a Cluster
-  section:
-  - docs/getting-started-guides/index.md
-  - title: Running Kubernetes on Your Local Machine
-    section:
-    - docs/getting-started-guides/minikube.md
-    - docs/getting-started-guides/alternatives.md
-  - title: Running Kubernetes on Turn-key Cloud Solutions
-    section:
-    - title: Running Kubernetes on Google Container Engine
-      path: https://cloud.google.com/container-engine/docs/before-you-begin/
-    - docs/getting-started-guides/gce.md
-    - docs/getting-started-guides/aws.md
-    - title: Running Kubernetes on Azure Container Service
-      path: https://docs.microsoft.com/en-us/azure/container-service/container-service-kubernetes-walkthrough
-    - docs/getting-started-guides/azure.md
-    - docs/getting-started-guides/clc.md
-    - title: Running Kubernetes on IBM SoftLayer
-      path: https://github.com/patrocinio/kubernetes-softlayer
-    - title: Running Kubernetes on Multiple Clouds with Stackpoint.io
-      path: /docs/getting-started-guides/stackpoint/
-  - title: Running Kubernetes on Custom Solutions
-    section:
-    - docs/getting-started-guides/scratch.md
-    - docs/getting-started-guides/kubeadm.md
-    - title: Custom Cloud Solutions
-      section:
-      - docs/getting-started-guides/coreos/index.md
-      - docs/getting-started-guides/ubuntu/index.md
-      - docs/getting-started-guides/rackspace.md
-      - docs/getting-started-guides/kops.md
-      - docs/getting-started-guides/kargo.md
-      - docs/getting-started-guides/running-cloud-controller.md
-    - title: On-Premise VMs
-      section:
-      - docs/getting-started-guides/coreos/index.md
-      - docs/getting-started-guides/cloudstack.md
-      - docs/getting-started-guides/vsphere.md
-      - docs/getting-started-guides/photon-controller.md
-      - docs/getting-started-guides/dcos.md
-      - docs/getting-started-guides/libvirt-coreos.md
-      - docs/getting-started-guides/ovirt.md
-      - docs/getting-started-guides/openstack-heat.md
-      - title: rkt
-        section:
-        - docs/getting-started-guides/rkt/index.md
-        - docs/getting-started-guides/rkt/notes.md
-      - docs/getting-started-guides/mesos/index.md
-      - docs/getting-started-guides/mesos-docker.md
-    - title: Bare Metal
-      section:
-      - docs/getting-started-guides/coreos/bare_metal_offline.md
-      - docs/getting-started-guides/fedora/fedora_ansible_config.md
-      - docs/getting-started-guides/fedora/fedora_manual_config.md
-      - docs/getting-started-guides/fedora/flannel_multi_node_cluster.md
-      - docs/getting-started-guides/centos/centos_manual_config.md
-      - docs/getting-started-guides/coreos/index.md
-      - docs/getting-started-guides/ubuntu/index.md
-      - title: Ubuntu
-        section:
-        - docs/getting-started-guides/ubuntu/index.md
-        - docs/getting-started-guides/ubuntu/validation.md
-        - docs/getting-started-guides/ubuntu/backups.md
-        - docs/getting-started-guides/ubuntu/upgrades.md
-        - docs/getting-started-guides/ubuntu/scaling.md
-        - docs/getting-started-guides/ubuntu/installation.md
-        - docs/getting-started-guides/ubuntu/monitoring.md
-        - docs/getting-started-guides/ubuntu/networking.md
-        - docs/getting-started-guides/ubuntu/security.md
-        - docs/getting-started-guides/ubuntu/storage.md
-        - docs/getting-started-guides/ubuntu/troubleshooting.md
-        - docs/getting-started-guides/ubuntu/decommissioning.md
-        - docs/getting-started-guides/ubuntu/calico.md
-        - docs/getting-started-guides/ubuntu/operational-considerations.md
-        - docs/getting-started-guides/ubuntu/glossary.md
-        - docs/getting-started-guides/ubuntu/local.md
-        - docs/getting-started-guides/ubuntu/logging.md
-        - docs/getting-started-guides/ubuntu/manual.md
-      - docs/getting-started-guides/windows/index.md
-    - docs/admin/node-conformance.md
-  - docs/getting-started-guides/docker-multinode.md
-  - docs/admin/cluster-large.md
-  - docs/admin/multiple-zones.md
-  - docs/admin/high-availability/index.md
-  - docs/getting-started-guides/binary_release.md
-
- title: Administering Clusters
-  section:
-  - docs/admin/index.md
-  - docs/admin/cluster-management.md
-  - docs/admin/upgrade-1-6.md
-  - docs/admin/kubeadm.md
-  - docs/admin/addons.md
-  - docs/admin/node-allocatable.md
-  - docs/admin/audit.md
-  - docs/admin/ha-master-gce.md
-  - docs/admin/namespaces/index.md
-  - docs/admin/namespaces/walkthrough.md
-  - docs/admin/limitrange/index.md
-  - docs/admin/disruptions.md
-  - docs/admin/resourcequota/index.md
-  - docs/admin/resourcequota/walkthrough.md
-  - docs/admin/resourcequota/limitstorageconsumption.md
-  - docs/admin/rescheduler.md
-  - docs/admin/sysctls.md
-  - docs/admin/cluster-components.md
-  - docs/admin/etcd.md
-  - docs/admin/etcd_upgrade.md
-  - docs/admin/multi-cluster.md
-  - title: Changing Cluster Size
-    path: https://github.com/kubernetes/kubernetes/wiki/User-FAQ#how-do-i-change-the-size-of-my-cluster/
-  - docs/admin/multiple-schedulers.md
-  - docs/admin/networking.md
-  - docs/admin/dns.md
-  - title: Setting Up and Configuring DNS
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/cluster-dns
-  - docs/admin/master-node-communication.md
-  - docs/admin/network-plugins.md
-  - docs/admin/static-pods.md
-  - docs/admin/garbage-collection.md
-  - docs/admin/out-of-resource.md
-  - docs/admin/salt.md
-  - docs/admin/node-problem.md
-  - docs/admin/apparmor/index.md
-
- title: Administering Federation
-  section:
-  - docs/admin/federation/kubefed.md
-  - title: Federated Kubernetes Objects
-    section:
-    - docs/user-guide/federation/index.md
-    - docs/user-guide/federation/configmap.md
-    - docs/user-guide/federation/daemonsets.md
-    - docs/user-guide/federation/deployment.md
-    - docs/user-guide/federation/events.md
-    - docs/user-guide/federation/federated-ingress.md
-    - docs/user-guide/federation/namespaces.md
-    - docs/user-guide/federation/replicasets.md
-    - docs/user-guide/federation/secrets.md
-    - docs/federation/api-reference/index.md
-  - title: Federation Components
-    section:
-    - docs/admin/federation-apiserver.md
-    - title : federation-controller-manager
-      path: /docs/admin/federation-controller-manager
@@ -1,211 +1,91 @@
 bigheader: "Reference Documentation"
 abstract: "Design docs, concept definitions, and references for APIs and CLIs."
 toc:
- docs/reference.md
+- docs/reference/index.md

- title: "Kubernetes Resource Types"
+- title: Using the API
  section:
-  - title: Version 1.6
-    path: /docs/resources-reference/v1.6/
-  - title: Version 1.5
-    path: /docs/resources-reference/v1.5/
-
- title: "Kubernetes API"
-  section:
-  - title: Version 1.6
-    path: /docs/api-reference/v1.6/
-  - title: Version 1.5
-    path: /docs/api-reference/v1.5/
-
- title: "Kubectl Commands"
-  section:
-  - title: Version 1.6
-    path: /docs/user-guide/kubectl/v1.6/
-  - title: Version 1.5
-    path: /docs/user-guide/kubectl/v1.5/
-
- title: Kubernetes API
-  section:
-  - docs/api.md
+  - docs/reference/api-overview.md
  - title: Accessing the API
    section:
    - docs/admin/accessing-the-api.md
    - docs/admin/authentication.md
    - docs/admin/bootstrap-tokens.md
-    - title: Authorization Plugins
-      section:
-      - docs/admin/authorization/index.md
-      - docs/admin/authorization/rbac.md
    - docs/admin/admission-controllers.md
    - docs/admin/service-accounts-admin.md
-  - docs/api-reference/v1/operations.html
-  - docs/api-reference/v1/definitions.html
-  - docs/api-reference/labels-annotations-taints.md
-  - kubernetes/third_party/swagger-ui/index.md
+  - title: Authorization
+    section:
+    - docs/admin/authorization/index.md
+    - docs/admin/authorization/abac.md
+    - docs/admin/authorization/rbac.md
+    - docs/admin/authorization/webhook.md
+  - docs/reference/deprecation-policy.md

- title: Autoscaling API
+- title: API Reference
  section:
-  - docs/api-reference/autoscaling/v1/operations.html
-  - docs/api-reference/autoscaling/v1/definitions.html
+  - title: v1.6
+    path: /docs/api-reference/v1.6/
+  - title: v1.5
+    path: /docs/api-reference/v1.5/
+  - docs/reference/labels-annotations-taints.md
+  - title: OpenAPI and Swagger
+    section:
+    - title: OpenAPI Spec
+      path: https://git.k8s.io/kubernetes/api/openapi-spec/
+    - title: Swagger Spec
+      path: https://git.k8s.io/kubernetes/api/swagger-spec/

- title: Batch API
+- title: Federation API
  section:
-  - docs/api-reference/batch/v1/operations.html
-  - docs/api-reference/batch/v1/definitions.html
-
- title: Apps API
-  section:
-  - title: Apps API Operations
-    path: /docs/api-reference/apps/v1beta1/operations/
-  - title: Apps API Definitions
-    path: /docs/api-reference/apps/v1beta1/definitions/
-
- title: Extensions API
-  section:
-  - docs/api-reference/extensions/v1beta1/operations.html
-  - docs/api-reference/extensions/v1beta1/definitions.html
+    - docs/reference/federation/v1/operations.html
+    - docs/reference/federation/v1/definitions.html
+    - docs/reference/federation/v1beta1/operations.html
+    - docs/reference/federation/v1beta1/definitions.html
+    - docs/reference/federation/extensions/v1beta1/operations.html
+    - docs/reference/federation/extensions/v1beta1/definitions.html

 - title: kubectl CLI
  section:
  - docs/user-guide/kubectl-overview.md
+  - title: v1.6 Commands
+    path: /docs/user-guide/kubectl/v1.6/
+  - title: v1.5 Commands
+    path: /docs/user-guide/kubectl/v1.5/
  - docs/user-guide/docker-cli-to-kubectl.md
  - docs/user-guide/kubectl-conventions.md
  - docs/user-guide/jsonpath.md
  - docs/user-guide/kubectl-cheatsheet.md
-  - title: kubectl Commands
-    section:
-    - docs/user-guide/kubectl/index.md
-    - docs/user-guide/kubectl/kubectl_annotate.md
-    - docs/user-guide/kubectl/kubectl_api-versions.md
-    - docs/user-guide/kubectl/kubectl_apply.md
-    - docs/user-guide/kubectl/kubectl_attach.md
-    - docs/user-guide/kubectl/kubectl_autoscale.md
-    - docs/user-guide/kubectl/kubectl_certificate.md
-    - docs/user-guide/kubectl/kubectl_certificate_approve.md
-    - docs/user-guide/kubectl/kubectl_certificate_deny.md
-    - docs/user-guide/kubectl/kubectl_cluster-info.md
-    - docs/user-guide/kubectl/kubectl_cluster-info_dump.md
-    - docs/user-guide/kubectl/kubectl_completion.md
-    - docs/user-guide/kubectl/kubectl_config.md
-    - docs/user-guide/kubectl/kubectl_config_current-context.md
-    - docs/user-guide/kubectl/kubectl_config_delete-cluster.md
-    - docs/user-guide/kubectl/kubectl_config_delete-context.md
-    - docs/user-guide/kubectl/kubectl_config_get-clusters.md
-    - docs/user-guide/kubectl/kubectl_config_get-contexts.md
-    - docs/user-guide/kubectl/kubectl_config_set-cluster.md
-    - docs/user-guide/kubectl/kubectl_config_set-context.md
-    - docs/user-guide/kubectl/kubectl_config_set-credentials.md
-    - docs/user-guide/kubectl/kubectl_config_set.md
-    - docs/user-guide/kubectl/kubectl_config_unset.md
-    - docs/user-guide/kubectl/kubectl_config_use-context.md
-    - docs/user-guide/kubectl/kubectl_config_view.md
-    - docs/user-guide/kubectl/kubectl_convert.md
-    - docs/user-guide/kubectl/kubectl_cordon.md
-    - docs/user-guide/kubectl/kubectl_cp.md
-    - docs/user-guide/kubectl/kubectl_create.md
-    - docs/user-guide/kubectl/kubectl_create_configmap.md
-    - docs/user-guide/kubectl/kubectl_create_deployment.md
-    - docs/user-guide/kubectl/kubectl_create_namespace.md
-    - docs/user-guide/kubectl/kubectl_create_quota.md
-    - docs/user-guide/kubectl/kubectl_create_secret_docker-registry.md
-    - docs/user-guide/kubectl/kubectl_create_secret.md
-    - docs/user-guide/kubectl/kubectl_create_secret_generic.md
-    - docs/user-guide/kubectl/kubectl_create_secret_tls.md
-    - docs/user-guide/kubectl/kubectl_create_serviceaccount.md
-    - docs/user-guide/kubectl/kubectl_create_service_clusterip.md
-    - docs/user-guide/kubectl/kubectl_create_service_loadbalancer.md
-    - docs/user-guide/kubectl/kubectl_create_service_nodeport.md
-    - docs/user-guide/kubectl/kubectl_delete.md
-    - docs/user-guide/kubectl/kubectl_describe.md
-    - docs/user-guide/kubectl/kubectl_drain.md
-    - docs/user-guide/kubectl/kubectl_edit.md
-    - docs/user-guide/kubectl/kubectl_exec.md
-    - docs/user-guide/kubectl/kubectl_explain.md
-    - docs/user-guide/kubectl/kubectl_expose.md
-    - docs/user-guide/kubectl/kubectl_get.md
-    - docs/user-guide/kubectl/kubectl_label.md
-    - docs/user-guide/kubectl/kubectl_logs.md
-    - docs/user-guide/kubectl/kubectl_options.md
-    - docs/user-guide/kubectl/kubectl_patch.md
-    - docs/user-guide/kubectl/kubectl_port-forward.md
-    - docs/user-guide/kubectl/kubectl_proxy.md
-    - docs/user-guide/kubectl/kubectl_replace.md
-    - docs/user-guide/kubectl/kubectl_rolling-update.md
-    - docs/user-guide/kubectl/kubectl_rollout.md
-    - docs/user-guide/kubectl/kubectl_rollout_history.md
-    - docs/user-guide/kubectl/kubectl_rollout_pause.md
-    - docs/user-guide/kubectl/kubectl_rollout_resume.md
-    - docs/user-guide/kubectl/kubectl_rollout_status.md
-    - docs/user-guide/kubectl/kubectl_rollout_undo.md
-    - docs/user-guide/kubectl/kubectl_run.md
-    - docs/user-guide/kubectl/kubectl_scale.md
-    - docs/user-guide/kubectl/kubectl_set.md
-    - docs/user-guide/kubectl/kubectl_set_image.md
-    - docs/user-guide/kubectl/kubectl_set_resources.md
-    - docs/user-guide/kubectl/kubectl_taint.md
-    - docs/user-guide/kubectl/kubectl_top.md
-    - docs/user-guide/kubectl/kubectl_top_node.md
-    - docs/user-guide/kubectl/kubectl_top_pod.md
-    - docs/user-guide/kubectl/kubectl_uncordon.md
-    - docs/user-guide/kubectl/kubectl_version.md
-    - title: Superseded and Deprecated Commands
-      section:
-      - /docs/user-guide/kubectl/kubectl_namespace/
-      - docs/user-guide/kubectl/kubectl_stop.md

- title: Kubernetes Components
+- docs/admin/kubeadm.md
+
+- title: Config Reference
  section:
+  - docs/admin/kubelet.md
  - docs/admin/kube-apiserver.md
  - docs/admin/kube-controller-manager.md
  - docs/admin/kube-proxy.md
  - docs/admin/kube-scheduler.md
-  - title: kubelet
-    section:
-    - docs/admin/kubelet.md
-    - docs/admin/master-node-communication.md
-    - docs/admin/kubelet-tls-bootstrapping.md
-    - docs/admin/kubelet-authentication-authorization.md
-
- title: Glossary
-  section:
-  - docs/user-guide/annotations.md
-  - docs/admin/daemons.md
-  - docs/user-guide/deployments.md
-  - docs/user-guide/horizontal-pod-autoscaling/index.md
-  - docs/user-guide/images.md
-  - docs/user-guide/ingress.md
-  - docs/user-guide/jobs.md
-  - docs/user-guide/labels.md
-  - docs/user-guide/identifiers.md
-  - docs/user-guide/namespaces.md
-  - docs/user-guide/networkpolicies.md
-  - docs/admin/node.md
-  - docs/user-guide/persistent-volumes/index.md
-  - docs/user-guide/petset.md
-  - docs/user-guide/pods/index.md
-  - docs/user-guide/pod-security-policy/index.md
-  - docs/user-guide/pod-preset/index.md
-  - docs/user-guide/replicasets.md
-  - docs/user-guide/replication-controller/index.md
-  - docs/admin/resourcequota/index.md
-  - docs/user-guide/cron-jobs.md
-  - docs/user-guide/secrets/index.md
-  - docs/user-guide/security-context.md
-  - docs/user-guide/services/index.md
-  - docs/user-guide/service-accounts.md
-  - docs/user-guide/thirdpartyresources.md
-  - docs/user-guide/volumes.md
+  - docs/admin/federation-apiserver.md
+  - docs/admin/federation-controller-manager.md

 - title: Kubernetes Design Docs
  section:
  - title: Kubernetes Architecture
-    path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/architecture.md
+    path: https://git.k8s.io/community/contributors/design-proposals/architecture.md
  - title: Kubernetes Design Overview
-    path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.6/docs/design
  - title: Kubernetes Identity and Access Management
-    path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/access.md
+    path: https://git.k8s.io/community/contributors/design-proposals/access.md
  - docs/admin/ovs-networking.md
  - title: Security Contexts
-    path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/security_context.md
+    path: https://git.k8s.io/community/contributors/design-proposals/security_context.md
  - title: Security in Kubernetes
-    path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/security.md
+    path: https://git.k8s.io/community/contributors/design-proposals/security.md
+
+- title: Kubernetes Issues and Security
+  section:
+  - title: Kubernetes Issue Tracker on GitHub
+    path: https://github.com/kubernetes/kubernetes/issues/
+  - docs/reference/security.md
+
+
@@ -1,75 +0,0 @@
-bigheader: "Samples"
-abstract: "A collection of example applications that show how to use Kubernetes."
-toc:
- docs/samples.md
-
- title: Storage / Database / KV
-  section:
-  - title: Apache Cassandra Database
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/cassandra
-  - title: Ceph
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/rbd/
-  - title: CephFS
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/cephfs/
-  - title: CockroachDB
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.4/examples/cockroachdb/
-  - title: GlusterFS
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/glusterfs/
-  - title: Hazelcast
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/hazelcast
-  - title: iSCSI
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/iscsi/
-  - title: MySQL Galera
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/mysql-galera
-  - title: NFS
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/nfs/
-  - title: Redis
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/redis/
-  - title: RethinkDB
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/rethinkdb/
-  - title: Vitess
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/vitess/
-
- title: Big Data
-  section:
-  - title: Apache Spark
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/spark
-  - title: Apache Storm
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storm
-
- title: Messaging / Queueing
-  section:
-  - title: Hazelcast
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/hazelcast
-
- title: Miscellaneous
-  section:
-  - title: Meteor Applications
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/meteor/
-  - title: OpenShift Origin
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/openshift-origin/
-  - title: Selenium
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/selenium/
-
- title: Monitoring and Logging
-  section:
-  - title: Elasticsearch
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/elasticsearch/
-  - title: NewRelic
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/newrelic
-
- title: Multi-tier Applications
-  section:
-  - title: Guestbook - Go Server
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/guestbook-go/
-  - title: GuestBook - PHP Server
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/guestbook/
-  - docs/getting-started-guides/meanstack.md
-  - title: MySQL + Wordpress
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/mysql-wordpress-pd/
-  - title: MySQL + Phabricator Server
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/phabricator/
-  - title: Nodejs + Mongo
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/nodesjs-mongodb
-  - title: Petstore
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/k8petstore/
@@ -0,0 +1,4 @@
+bigheader: ""
+abstract: ""
+toc:
+- docs/search.md
@@ -0,0 +1,107 @@
+bigheader: "Setup"
+abstract: "Instructions for setting up a Kubernetes cluster."
+toc:
+- docs/setup/index.md
+- docs/setup/pick-right-solution.md
+
+- title: Independent Solutions
+  section:
+  - docs/getting-started-guides/minikube.md
+
+  - title: Bootstrapping Clusters with kubeadm
+    section:
+    - docs/setup/independent/install-kubeadm.md
+    - docs/setup/independent/create-cluster-kubeadm.md
+
+  - docs/getting-started-guides/scratch.md
+  - docs/getting-started-guides/alternatives.md
+
+- title: Hosted Solutions
+  section:
+  - title: Running Kubernetes on Google Container Engine
+    path: https://cloud.google.com/container-engine/docs/before-you-begin/
+  - title: Running Kubernetes on Azure Container Service
+    path: https://docs.microsoft.com/en-us/azure/container-service/container-service-kubernetes-walkthrough
+  - title: Running Kubernetes on IBM Bluemix Container Service
+    path: https://console.ng.bluemix.net/docs/containers/container_index.html
+
+- title: Turn-key Cloud Solutions
+  section:
+  - docs/getting-started-guides/gce.md
+  - docs/getting-started-guides/aws.md
+  - docs/getting-started-guides/azure.md
+  - docs/getting-started-guides/clc.md
+  - title: Running Kubernetes on IBM Bluemix
+    path: https://github.com/patrocinio/kubernetes-softlayer
+  - docs/getting-started-guides/stackpoint.md
+
+- title: Custom Solutions
+
+  section:
+  - title: Custom Cloud Solutions
+    section:
+    - docs/getting-started-guides/coreos/index.md
+    - docs/getting-started-guides/ubuntu/index.md
+    - docs/getting-started-guides/kops.md
+    - docs/getting-started-guides/kubespray.md
+    - docs/getting-started-guides/running-cloud-controller.md
+
+  - title: On-Premise VMs
+    section:
+    - docs/getting-started-guides/coreos/index.md
+    - docs/getting-started-guides/cloudstack.md
+    - docs/getting-started-guides/vsphere.md
+    - docs/getting-started-guides/photon-controller.md
+    - docs/getting-started-guides/dcos.md
+    - docs/getting-started-guides/libvirt-coreos.md
+    - docs/getting-started-guides/ovirt.md
+    - docs/getting-started-guides/openstack-heat.md
+
+    - title: rkt
+      section:
+      - docs/getting-started-guides/rkt/index.md
+      - docs/getting-started-guides/rkt/notes.md
+
+    - docs/getting-started-guides/mesos/index.md
+    - docs/getting-started-guides/mesos-docker.md
+
+    - title: Bare Metal
+      section:
+      - docs/getting-started-guides/coreos/bare_metal_offline.md
+      - docs/getting-started-guides/fedora/fedora_ansible_config.md
+      - docs/getting-started-guides/fedora/fedora_manual_config.md
+      - docs/getting-started-guides/fedora/flannel_multi_node_cluster.md
+      - docs/getting-started-guides/centos/centos_manual_config.md
+      - docs/getting-started-guides/coreos/index.md
+      - docs/getting-started-guides/ubuntu/index.md
+
+      - title: Ubuntu
+        section:
+        - docs/getting-started-guides/ubuntu/index.md
+        - docs/getting-started-guides/ubuntu/validation.md
+        - docs/getting-started-guides/ubuntu/backups.md
+        - docs/getting-started-guides/ubuntu/upgrades.md
+        - docs/getting-started-guides/ubuntu/scaling.md
+        - docs/getting-started-guides/ubuntu/installation.md
+        - docs/getting-started-guides/ubuntu/monitoring.md
+        - docs/getting-started-guides/ubuntu/networking.md
+        - docs/getting-started-guides/ubuntu/security.md
+        - docs/getting-started-guides/ubuntu/storage.md
+        - docs/getting-started-guides/ubuntu/troubleshooting.md
+        - docs/getting-started-guides/ubuntu/decommissioning.md
+        - docs/getting-started-guides/ubuntu/operational-considerations.md
+        - docs/getting-started-guides/ubuntu/glossary.md
+        - docs/getting-started-guides/ubuntu/local.md
+        - docs/getting-started-guides/ubuntu/logging.md
+        - docs/getting-started-guides/ubuntu/manual.md
+
+    - docs/getting-started-guides/windows/index.md
+
+  - docs/admin/node-conformance.md
+
+- docs/concepts/cluster-administration/addons.md
+- docs/admin/salt.md
+- docs/admin/cluster-large.md
+- docs/admin/multiple-zones.md
+- docs/admin/high-availability/index.md
+- docs/getting-started-guides/binary_release.md
@@ -1,44 +0,0 @@
-bigheader: "Support"
-abstract: "Troubleshooting resources, frequently asked questions, and community support channels."
-toc:
- docs/troubleshooting.md
-
- title: Troubleshooting
-  section:
-  - docs/user-guide/debugging-pods-and-replication-controllers.md
-  - docs/user-guide/introspection-and-debugging.md
-  - docs/user-guide/application-troubleshooting.md
-  - docs/admin/cluster-troubleshooting.md
-  - docs/user-guide/debugging-services.md
-
- title: Frequently Asked Questions
-  section:
-  - title: User FAQ
-    path: https://github.com/kubernetes/kubernetes/wiki/User-FAQ/
-  - title: Debugging FAQ
-    path: https://github.com/kubernetes/kubernetes/wiki/Debugging-FAQ/
-  - title: Services FAQ
-    path: https://github.com/kubernetes/kubernetes/wiki/Services-FAQ/
-
- title: Contributing to the Kubernetes Docs
-  section:
-  - editdocs.md
-  - docs/contribute/create-pull-request.md
-  - docs/contribute/write-new-topic.md
-  - docs/contribute/stage-documentation-changes.md
-  - docs/contribute/page-templates.md
-  - docs/contribute/review-issues.md
-  - docs/contribute/style-guide.md
-
- title: Other Resources
-  section:
-  - title: Kubernetes Issue Tracker on GitHub
-    path: https://github.com/kubernetes/kubernetes/issues/
-  - docs/reporting-security-issues.md
-  - title: Release Notes
-    path: https://github.com/kubernetes/kubernetes/releases/
-  - title: Release Roadmap
-    path: https://github.com/kubernetes/kubernetes/milestones/
-
- title: Deprecation Policy
-  path: /docs/deprecation-policy.md
@@ -3,77 +3,142 @@ abstract: "Step-by-step instructions for performing operations with Kubernetes."
 toc:
 - docs/tasks/index.md

- title: Using the kubectl Command-Line
+- title: Install Tools
  section:
-  - docs/tasks/kubectl/install.md
-  - docs/tasks/kubectl/list-all-running-container-images.md
-  - docs/tasks/kubectl/get-shell-running-container.md
+  - docs/tasks/tools/install-kubectl.md
+  - docs/tasks/tools/install-minikube.md
+  - docs/setup/independent/install-kubeadm.md

- title: Configuring Pods and Containers
+- title: Configure Pods and Containers
  section:
-  - docs/tasks/configure-pod-container/define-environment-variable-container.md
-  - docs/tasks/configure-pod-container/define-command-argument-container.md
  - docs/tasks/configure-pod-container/assign-cpu-ram-container.md
-  - docs/tasks/configure-pod-container/limit-range.md
-  - docs/tasks/configure-pod-container/apply-resource-quota-limit.md
  - docs/tasks/configure-pod-container/configure-volume-storage.md
  - docs/tasks/configure-pod-container/configure-persistent-volume-storage.md
+  - docs/tasks/configure-pod-container/configure-projected-volume-storage.md
+  - docs/tasks/configure-pod-container/projected-volume.md
+  - docs/tasks/configure-pod-container/security-context.md
  - docs/tasks/configure-pod-container/environment-variable-expose-pod-information.md
-  - docs/tasks/configure-pod-container/downward-api-volume-expose-pod-information.md
-  - docs/tasks/configure-pod-container/distribute-credentials-secure.md
+  - docs/tasks/configure-pod-container/configure-service-account.md
  - docs/tasks/configure-pod-container/pull-image-private-registry.md
  - docs/tasks/configure-pod-container/configure-liveness-readiness-probes.md
-  - docs/tasks/configure-pod-container/communicate-containers-same-pod.md
+  - docs/tasks/configure-pod-container/assign-pods-nodes.md
  - docs/tasks/configure-pod-container/configure-pod-initialization.md
  - docs/tasks/configure-pod-container/attach-handler-lifecycle-event.md
-  - docs/tasks/configure-pod-container/configure-pod-disruption-budget.md
+  - docs/tasks/configure-pod-container/configmap.md
+  - docs/tasks/configure-pod-container/configure-pod-configmap.md
+  - docs/tools/kompose/user-guide.md

- title: Running Applications
+- title: Inject Data Into Applications
  section:
-  - docs/tasks/run-application/rolling-update-replication-controller.md
+  - docs/tasks/inject-data-application/define-command-argument-container.md
+  - docs/tasks/inject-data-application/define-environment-variable-container.md
+  - docs/tasks/inject-data-application/environment-variable-expose-pod-information.md
+  - docs/tasks/inject-data-application/downward-api-volume-expose-pod-information.md
+  - docs/tasks/inject-data-application/distribute-credentials-secure.md
+  - docs/tasks/inject-data-application/podpreset.md

- title: Running Jobs
+- title: Run Applications
+  section:
+  - docs/tasks/run-application/run-stateless-application-deployment.md
+  - docs/tasks/run-application/run-single-instance-stateful-application.md
+  - docs/tasks/run-application/run-replicated-stateful-application.md
+  - docs/tasks/run-application/upgrade-pet-set-to-stateful-set.md
+  - docs/tasks/run-application/scale-stateful-set.md
+  - docs/tasks/run-application/delete-stateful-set.md
+  - docs/tasks/run-application/force-delete-stateful-set-pod.md
+  - docs/tasks/run-application/rolling-update-replication-controller.md
+  - docs/tasks/run-application/horizontal-pod-autoscale.md
+  - docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md
+
+- title: Run Jobs
  section:
  - docs/tasks/job/parallel-processing-expansion.md
  - docs/tasks/job/coarse-parallel-processing-work-queue/index.md
  - docs/tasks/job/fine-parallel-processing-work-queue/index.md

- title: Accessing Applications in a Cluster
+- title: Access Applications in a Cluster
  section:
+  - docs/tasks/access-application-cluster/web-ui-dashboard.md
+  - docs/tasks/access-application-cluster/access-cluster.md
+  - docs/tasks/access-application-cluster/authenticate-across-clusters-kubeconfig.md
  - docs/tasks/access-application-cluster/port-forward-access-application-cluster.md
  - docs/tasks/access-application-cluster/load-balance-access-application-cluster.md
+  - docs/tasks/access-application-cluster/service-access-application-cluster.md
+  - docs/tasks/access-application-cluster/connecting-frontend-backend.md
  - docs/tasks/access-application-cluster/create-external-load-balancer.md
  - docs/tasks/access-application-cluster/configure-cloud-provider-firewall.md
+  - docs/tasks/access-application-cluster/list-all-running-container-images.md
+  - docs/tasks/access-application-cluster/communicate-containers-same-pod-shared-volume.md
+  - title: Configuring DNS for a Cluster
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/cluster-dns

- title: Monitoring, Logging, and Debugging
+- title: Monitor, Log, and Debug
  section:
+  - docs/tasks/debug-application-cluster/resource-usage-monitoring.md
+  - docs/tasks/debug-application-cluster/get-shell-running-container.md
+  - docs/tasks/debug-application-cluster/monitor-node-health.md
+  - docs/tasks/debug-application-cluster/logging-stackdriver.md
+  - docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md
  - docs/tasks/debug-application-cluster/determine-reason-pod-failure.md
  - docs/tasks/debug-application-cluster/debug-init-containers.md
-  - docs/tasks/debug-application-cluster/logging-stackdriver.md
-  - docs/tasks/debug-application-cluster/monitor-node-health.md
-  - docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md
+  - docs/tasks/debug-application-cluster/debug-pod-replication-controller.md
+  - docs/tasks/debug-application-cluster/debug-service.md
+  - docs/tasks/debug-application-cluster/debug-cluster.md
+  - docs/tasks/debug-application-cluster/debug-application.md
+  - docs/tasks/debug-application-cluster/debug-stateful-set.md
+  - docs/tasks/debug-application-cluster/debug-application-introspection.md
+  - docs/tasks/debug-application-cluster/audit.md
+  - title: Use Explorer to Examine the Runtime Environment
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/explorer

- title: Accessing the Kubernetes API
+- title: Access and Extend the Kubernetes API
  section:
  - docs/tasks/access-kubernetes-api/http-proxy-access-api.md
+  - docs/tasks/access-kubernetes-api/extend-api-third-party-resource.md

- title: Using TLS
+- title: TLS
  section:
  - docs/tasks/tls/managing-tls-in-a-cluster.md

- title: Administering a Cluster
+- title: Administer a Cluster
  section:
-  - docs/tasks/administer-cluster/overview.md
-  - docs/tasks/administer-cluster/assign-pods-nodes.md
+  - docs/tasks/administer-cluster/access-cluster-api.md
+  - docs/tasks/administer-cluster/access-cluster-services.md
+  - docs/tasks/administer-cluster/configure-upgrade-etcd.md
+  - docs/tasks/administer-cluster/apply-resource-quota-limit.md
+  - docs/tasks/administer-cluster/out-of-resource.md
+  - docs/tasks/administer-cluster/cpu-memory-limit.md
+  - docs/tasks/administer-cluster/reserve-compute-resources.md
+  - docs/tasks/administer-cluster/static-pod.md
+  - docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods.md
+  - docs/tasks/administer-cluster/cluster-management.md
+  - docs/tasks/administer-cluster/upgrade-1-6.md
+  - docs/tasks/administer-cluster/namespaces.md
+  - docs/tasks/administer-cluster/namespaces-walkthrough.md
  - docs/tasks/administer-cluster/dns-horizontal-autoscaling.md
  - docs/tasks/administer-cluster/safely-drain-node.md
+  - docs/tasks/administer-cluster/declare-network-policy.md
+  - docs/tasks/administer-cluster/calico-network-policy.md
+  - docs/tasks/administer-cluster/romana-network-policy.md
+  - docs/tasks/administer-cluster/weave-network-policy.md
  - docs/tasks/administer-cluster/change-pv-reclaim-policy.md
+  - docs/tasks/administer-cluster/configure-pod-disruption-budget.md
  - docs/tasks/administer-cluster/limit-storage-consumption.md
  - docs/tasks/administer-cluster/change-default-storage-class.md
  - docs/tasks/administer-cluster/share-configuration.md
+  - docs/tasks/administer-cluster/running-cloud-controller.md
+  - docs/tasks/administer-cluster/highly-available-master.md
+  - docs/tasks/administer-cluster/configure-multiple-schedulers.md
+  - docs/tasks/administer-cluster/ip-masq-agent.md
+  - title: Change Cluster Size
+    path: https://github.com/kubernetes/kubernetes/wiki/User-FAQ#how-do-i-change-the-size-of-my-cluster/

- title: Administering Federation
+- title: Federation - Run an App on Multiple Clusters
  section:
+  - docs/tasks/federation/federation-service-discovery.md
+  - docs/tasks/federation/set-up-cluster-federation-kubefed.md
+  - docs/tasks/federation/set-up-coredns-provider-federation.md
+  - docs/tasks/administer-federation/cluster.md
  - docs/tasks/administer-federation/configmap.md
  - docs/tasks/administer-federation/daemonset.md
  - docs/tasks/administer-federation/deployment.md
@@ -83,14 +148,12 @@ toc:
  - docs/tasks/administer-federation/replicaset.md
  - docs/tasks/administer-federation/secret.md

- title: Managing Stateful Applications
-  section:
-  - docs/tasks/manage-stateful-set/upgrade-pet-set-to-stateful-set.md
-  - docs/tasks/manage-stateful-set/scale-stateful-set.md
-  - docs/tasks/manage-stateful-set/deleting-a-statefulset.md
-  - docs/tasks/manage-stateful-set/debugging-a-statefulset.md
-  - docs/tasks/manage-stateful-set/delete-pods.md
-
- title: Managing Cluster Daemons
+- title: Manage Cluster Daemons
  section:
  - docs/tasks/manage-daemon/update-daemon-set.md
+
+- title: Manage GPUs
+  section:
+  - docs/tasks/manage-gpus/scheduling-gpus.md
+
+
@@ -32,6 +32,9 @@ toc:
 - title: Online Training Course
  path: https://www.udacity.com/course/scalable-microservices-with-kubernetes--ud615
 - docs/tutorials/stateless-application/hello-minikube.md
+- title: Configuration
+  section:
+  - docs/tutorials/configuration/configure-redis-using-configmap.md
 - title: Object Management Using kubectl
  section:
  - docs/tutorials/object-management-kubectl/object-management.md
@@ -40,25 +43,22 @@ toc:
  - docs/tutorials/object-management-kubectl/declarative-object-management-configuration.md
 - title: Stateless Applications
  section:
-  - docs/tutorials/stateless-application/run-stateless-application-deployment.md
-  - docs/tutorials/stateless-application/expose-external-ip-address-service.md
+  - docs/tasks/run-application/run-stateless-application-deployment.md
+  - docs/tutorials/stateless-application/guestbook.md
+  - docs/tasks/access-application-cluster/service-access-application-cluster.md
  - docs/tutorials/stateless-application/expose-external-ip-address.md
-  - docs/tutorials/stateless-application/run-stateless-ap-replication-controller.md
 - title: Stateful Applications
  section:
  - docs/tutorials/stateful-application/basic-stateful-set.md
-  - docs/tutorials/stateful-application/run-stateful-application.md
-  - docs/tutorials/stateful-application/run-replicated-stateful-application.md
+  - docs/tasks/run-application/run-single-instance-stateful-application.md
+  - docs/tasks/run-application/run-replicated-stateful-application.md
+  - docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md
+  - docs/tutorials/stateful-application/cassandra.md
  - docs/tutorials/stateful-application/zookeeper.md
- title: Connecting Applications
-  section:
-  - docs/tutorials/connecting-apps/connecting-frontend-backend.md
 - title: Clusters
  section:
  - docs/tutorials/clusters/apparmor.md
 - title: Services
  section:
  - docs/tutorials/services/source-ip.md
- title: Federated Cluster Administration
-  section:
-  - docs/tutorials/federation/set-up-cluster-federation-kubefed.md
+
@@ -0,0 +1,3 @@
+# Prevent bots from indexing site
+/*
+  X-Robots-Tag: noindex
@@ -1 +0,0 @@
-***NOTE: This feature is beta in Kubernetes 1.5.***
@@ -0,0 +1,2 @@
+The topics in the `/docs/api-reference/` section of the Kubernetes docs
+are being moved to the [Reference](/docs/reference/) section. The content in this topic has moved to:
@@ -0,0 +1,28 @@
+<a href="#" id="feature-state-dialog-link" class="ui-state-default ui-corner-all"><span class="ui-icon ui-icon-newwin"></span>{{ dialog_title }}</a>
+<div id="feature-state-dialog" class="ui-dialog-content" title="{{ dialog_title }}">
+{{ dialog_content | markdownify }}
+</div>
+{% raw %}<script>
+$(function(){
+    
+    $( "#feature-state-dialog" ).dialog({
+        autoOpen: false,
+        width: {% endraw %}{{ dialog_width | default: "600" }}{% raw %},
+        buttons: [
+            {
+                text: "Ok",
+                click: function() {
+                    $( this ).dialog( "close" );
+                }
+            }
+        ]
+    });
+
+    // Link to open the dialog
+    $( "#feature-state-dialog-link" ).click(function( event ) {
+        $( "#feature-state-dialog" ).dialog( "open" );
+        event.preventDefault();
+    });
+
+});
+</script>{% endraw %}
@@ -0,0 +1,13 @@
+{% assign dialog_title = "alpha" %}
+{% capture dialog_content %}
+This feature is currently in a *alpha* state, meaning:
+
+* The version names contain alpha (e.g. v1alpha1).
+* Might be buggy. Enabling the feature may expose bugs. Disabled by default.
+* Support for feature may be dropped at any time without notice.
+* The API may change in incompatible ways in a later software release without notice.
+* Recommended for use only in short-lived testing clusters, due to increased risk of bugs and lack of long-term support.
+
+{% endcapture %}
+
+**FEATURE STATE:** `Kubernetes {{ for_k8s_version | default: page.version }}` {% include feature-dialog.md %}
@@ -0,0 +1,14 @@
+{% assign dialog_title = "beta" %}
+{% capture dialog_content %}
+This feature is currently in a *beta* state, meaning:
+
+* The version names contain beta (e.g. v2beta3).
+* Code is well tested. Enabling the feature is considered safe. Enabled by default.
+* Support for the overall feature will not be dropped, though details may change.
+* The schema and/or semantics of objects may change in incompatible ways in a subsequent beta or stable release. When this happens, we will provide instructions for migrating to the next version. This may require deleting, editing, and re-creating API objects. The editing process may require some thought. This may require downtime for applications that rely on the feature.
+* Recommended for only non-business-critical uses because of potential for incompatible changes in subsequent releases. If you have multiple clusters that can be upgraded independently, you may be able to relax this restriction.
+* **Please do try our beta features and give feedback on them! After they exit beta, it may not be practical for us to make more changes.**
+
+{% endcapture %}
+
+**FEATURE STATE:** `Kubernetes {{ for_k8s_version | default: page.version }}` {% include feature-dialog.md %}
@@ -0,0 +1,6 @@
+{% assign dialog_title = "deprecated" %}
+{% capture dialog_content %}
+This feature is *deprecated*. For more information on this state, see the [Kubernetes Deprecation Policy](/docs/reference/deprecation-policy/).
+{% endcapture %}
+
+**DEPRECATION NOTICE:** As of `Kubernetes {{ for_k8s_version | default: page.version }}`, this has been {% include feature-dialog.md %}
@@ -0,0 +1,10 @@
+{% assign dialog_title = "stable" %}
+{% capture dialog_content %}
+This feature is *stable*, meaning:
+
+* The version name is vX where X is an integer.
+* Stable versions of features will appear in released software for many subsequent versions.
+
+{% endcapture %}
+
+**FEATURE STATE:** `Kubernetes {{ for_k8s_version | default: page.version }}` {% include feature-dialog.md %}
@@ -0,0 +1,8 @@
+This guide assumes that you have a running Kubernetes Cluster
+Federation installation. If not, then head over to the
+[federation admin guide](/docs/tutorials/federation/set-up-cluster-federation-kubefed/) to learn how to
+bring up a cluster federation (or have your cluster administrator do
+this for you).
+Other tutorials, such as Kelsey Hightower's 
+[Federated Kubernetes Tutorial](https://github.com/kelseyhightower/kubernetes-cluster-federation),
+might also help you create a Federated Kubernetes cluster.
@@ -0,0 +1,2 @@
+The topics in the [Federation API](/docs/federation/api-reference/) section of the Kubernetes docs
+are being moved to the [Reference](/docs/reference/) section. The content in this topic has moved to:
@@ -1,8 +1,8 @@
 <footer>
    <main class="light-text">
        <nav>
-            <a href="/docs/hellonode/">Get Started</a>
-            <a href="/docs/">Documentation</a>
+            <a href="/docs/tutorials/stateless-application/hello-minikube/">Get Started</a>
+            <a href="/docs/home/">Documentation</a>
            <a href="http://blog.kubernetes.io/">Blog</a>
            <a href="/partners/">Partners</a>
            <a href="/community/">Community</a>
@@ -20,12 +20,12 @@
                <a href="https://calendar.google.com/calendar/embed?src=nt2tcnbtbied3l6gi2h29slvc0%40group.calendar.google.com" class="calendar"><span>Events Calendar</span></a>
            </div>
            <div>
-                <a href="//get.k8s.io" class="button">Download K8s</a>
-                <a href="https://github.com/kubernetes/kubernetes" class="button">Contribute to the K8s codebase</a>
+                <a href="/docs/setup/pick-right-solution/" class="button">Get Kubernetes</a>
+                <a href="https://github.com/kubernetes/kubernetes" class="button">Contribute</a>
            </div>
        </div>
        <div id="miceType" class="center">
-            &copy; {{ 'now' | date: "%Y" }} The Kubernetes Authors | Documentation Distributed under <a href="https://github.com/kubernetes/kubernetes.github.io/blob/master/LICENSE" class="light-text">CC BY 4.0</a>
+            &copy; {{ 'now' | date: "%Y" }} The Kubernetes Authors | Documentation Distributed under <a href="https://git.k8s.io/kubernetes.github.io/LICENSE" class="light-text">CC BY 4.0</a>
        </div>
        <div id="miceType" class="center">
            Copyright &copy; {{ 'now' | date: "%Y" }} The Linux Foundation&reg;. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page: <a href="https://www.linuxfoundation.org/trademark-usage" class="light-text">https://www.linuxfoundation.org/trademark-usage</a>
@@ -2,12 +2,19 @@
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="shortcut icon" type="image/png" href="/images/favicon.png">
-    <link href='https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900,900italic' rel='stylesheet' type='text/css'>
-    <link rel="stylesheet" href='https://fonts.googleapis.com/css?family=Roboto+Mono' type='text/css'>
-    <link rel="stylesheet" href="/css/styles.css"/>
-    <link rel="stylesheet" href="/css/jquery-ui.min.css">
-    <link rel="stylesheet" href="/css/sweetalert.css">
-    {% if page.class == "gridPage" %}<link rel="stylesheet" href="/css/gridpage.css">{% endif %}
+    <link rel="stylesheet" type="text/css" href="https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900,900italic">
+    <link rel="stylesheet" type="text/css" href="https://fonts.googleapis.com/css?family=Roboto+Mono">
+    <link rel="stylesheet" type="text/css" href="/css/styles.css">
+    <link rel="stylesheet" type="text/css" href="/css/jquery-ui.min.css">
+    <link rel="stylesheet" type="text/css" href="/css/sweetalert.css">
+    {% if page.class == "gridPage" %}<link rel="stylesheet" type="text/css" href="/css/gridpage.css">{% endif %}
+
+    {% if page.description %}
+    <meta name="description" content="{{ page.description }}" />
+    {% else %}
+    <meta name="description" content="{{ page.title }}" />
+    {% endif %}
+
    <script src="/js/jquery-2.2.0.min.js"></script>
    <script src="/js/jquery-ui.min.js"></script>
    <script src="/js/script.js"></script>
@@ -5,13 +5,13 @@

    <div class="nav-buttons" data-auto-burger="primary">
        <ul class="global-nav">
-            <li><a href="/docs/">Documentation</a></li>
+            <li><a href="/docs/home/">Documentation</a></li>
            <li><a href="http://blog.kubernetes.io/">Blog</a></li>
            <li><a href="/partners/">Partners</a></li>
            <li><a href="/community/">Community</a></li>
            <li><a href="/case-studies/">Case Studies</a></li>
        </ul>
-        <!-- <a href="/docs/" class="button" id="viewDocs" data-auto-burger-exclude>View Documentation</a> -->
+        <!-- <a href="/docs/home" class="button" id="viewDocs" data-auto-burger-exclude>View Documentation</a> -->
        <a href="/docs/tutorials/kubernetes-basics/" class="button" id="tryKubernetes" data-auto-burger-exclude>Try Kubernetes</a>
        <button id="hamburger" onclick="kub.toggleMenu()" data-auto-burger-exclude><div></div></button>
    </div>
@@ -19,11 +19,11 @@
    <nav id="mainNav">
        <main data-auto-burger="primary">
        <div class="nav-box">
-            <h3><a href="/docs/hellonode/">Get Started</a></h3>
+            <h3><a href="/docs/tutorials/stateless-application/hello-minikube/">Get Started</a></h3>
            <p>Ready to get your hands dirty? Build a simple Kubernetes cluster that runs "Hello World" for Node.js.</p>
        </div>
        <div class="nav-box">
-            <h3><a href="/docs/">Documentation</a></h3>
+            <h3><a href="/docs/home/">Documentation</a></h3>
            <p>Learn how to use Kubernetes with the use of walkthroughs, samples, and reference documentation. You can even <a href="/editdocs/" data-auto-burger-exclude>help contribute to the docs</a>!</p>
        </div>
        <div class="nav-box">
@@ -391,6 +391,132 @@
 			logo: 'avinetworks',
 			link: 'https://kb.avinetworks.com/avi-vantage-openshift-installation-guide/',
 			blurb: 'Avis elastic application services fabric provides scalable, feature rich & integrated L4-7 networking for K8S environments.'
+  		},
+		{
+ 			type: 1,
+ 			name: 'codecrux web technologies pvt ltd',
+ 			logo: 'codecrux',
+ 			link: 'http://codecrux.com/kubernetes/',
+ 			blurb: 'At CodeCrux we help your organization get the most out of Containers and Kubernetes, regardless of where you are in your journey'
+  		},
+		{
+ 			type: 0,
+ 			name: 'Greenqloud',
+ 			logo: 'qstack',
+ 			link: 'https://www.qstack.com/application-orchestration/',
+ 			blurb: 'Qstack provides self-serviceable on-site Kubernetes clusters with an intuitive User Interface for Infrastructure and Kubernetes management.'
+  		},
+		{
+ 			type: 1,
+ 			name: 'StackOVerdrive.io',
+ 			logo: 'stackoverdrive',
+ 			link: 'http://www.stackoverdrive.net/kubernetes-consulting/',
+ 			blurb: 'We are a devops consulting firm and we do alot of work with containers and Kunbernetes is one of our go to tools.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'F5 Networks',
+ 			logo: 'f5networks',
+ 			link: 'https://f5.com/about-us/news/press-kit',
+ 			blurb: 'Integration of our ADC services with Kubernetes'
+  		},
+		{
+ 			type: 0,
+ 			name: 'StackIQ, Inc.',
+ 			logo: 'stackiq',
+ 			link: 'https://www.stackiq.com/kubernetes/',
+ 			blurb: 'With Stacki and the Stacki Pallet for Kubernetes, you can go from bare metal to containers in one step very quickly and easily.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'Cobe',
+ 			logo: 'cobe',
+ 			link: 'https://cobe.io/blog/posts/problems-within-your-kubernetes-cluster/',
+ 			blurb: 'Manage Kubernetes clusters with a live, searchable model that captures all relationships and performance data in full visualised context.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'Datawire',
+ 			logo: 'datawire',
+ 			link: 'http://www.datawire.io',
+ 			blurb: 'Datawires open source tools let your microservices developers be awesomely productive on Kubernetes, while letting ops sleep at night.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'Mashape, Inc.',
+ 			logo: 'mashape',
+ 			link: 'https://getkong.org/install/kubernetes/',
+ 			blurb: 'Kong is a scalable open source API layer that runs in front of any RESTful API and can be provisioned to a Kubernetes cluster.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'F5 Networks',
+ 			logo: 'f5networks',
+ 			link: 'http://github.com/f5networks',
+ 			blurb: 'We have a LB integration into Kubernetes.'
+  		},
+		{
+ 			type: 1,
+ 			name: 'Lovable Tech',
+ 			logo: 'lovable',
+ 			link: 'https://drive.google.com/file/d/0BxCnAyMK1pgBTUFOdEZsUndLa01xMGJYZWtUVmVOdldadk80/view?usp=sharing',
+ 			blurb: ''
+  		},
+		{
+ 			type: 0,
+ 			name: 'StackState',
+ 			logo: 'stackstate',
+ 			link: 'http://stackstate.com/platform/container-monitoring',
+ 			blurb: 'Operational Analytics across teams and tools. Includes topology visualization, root cause analysis and anomaly detection for Kubernetes.'
+  		},
+		{
+ 			type: 1,
+ 			name: 'INEXCCO INC',
+ 			logo: 'inexcco',
+ 			link: 'https://www.inexcco.com/',
+ 			blurb: 'Strong DevOps and Cloud talent working with couple clients on kubernetes and helm implementations. '
+  		},
+		{
+ 			type: 0,
+ 			name: 'Bitnami',
+ 			logo: 'bitnami',
+ 			link: 'http://bitnami.com/kubernetes',
+ 			blurb: 'Bitnami brings a catalog of trusted, up to date, and easy to use applications and application building blocks to Kubernetes.'
+  		},
+		{
+ 			type: 1,
+ 			name: 'Nebulaworks',
+ 			logo: 'nebulaworks',
+ 			link: 'http://www.nebulaworks.com/container-platforms',
+ 			blurb: 'Nebulaworks provides services to help the enterprise adopt modern container platforms and optimized processes to enable innovation at scale.'
+  		},
+		{
+ 			type: 1,
+ 			name: 'EASYNUBE LTD',
+ 			logo: 'easynube',
+ 			link: 'https://www.carrefour.es/supermercado/?ic_source=portal-home&ic_medium=menu-links&ic_content=section-home',
+ 			blurb: 'Provide consultancy, architecture and implementation'
+  		},
+		{
+ 			type: 1,
+ 			name: 'Opcito Technologies',
+ 			logo: 'opcito',
+ 			link: 'http://www.opcito.com/kubernetes/',
+ 			blurb: 'Opcito is a software consultancy that uses Kubernetes to help organisations build, architect & deploy highly scalable applications.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'Huawei Technologies Co., Ltd.',
+ 			logo: 'huawei',
+ 			link: 'http://developer.huawei.com/ict/en/site-paas',
+ 			blurb: 'FusionStage is an enterprise-grade PaaS, the core of which is based on open source container technology including Kubernetes and Docker.'
+  		},
+		{
+ 			type: 0,
+ 			name: '{code} by Dell EMC',
+ 			logo: 'codedellemc',
+ 			link: 'https://blog.codedellemc.com',
+ 			blurb: 'Respected as a thought leader in storage persistence for containerized applications. Contributed significant work to K8 and Ecosystem'
  		}
 		
 	]
@@ -1,17 +0,0 @@
-{% assign tabsraw = tabspec | newline_to_br | split: '<br />' %}
-{% assign tabsetname = tabsraw[0] %}
-<script>$(function(){$("#{{tabsetname}}").tabs();});</script>
-<div id="{{tabsetname}}">
-  <ul>{% for tab in tabsraw offset:1 %}{% assign thisTab = tab | split: ',' %}
-    <li><a href="#{{ thisTab[0] | strip | handleize }}">{{ thisTab[0] | strip}}</a></li>{% endfor %}
-  </ul>
-  {% for tab in tabsraw offset:1 %}
-  {% assign thisTab = tab | split: ',' %}
-  {% assign tabLang=thisTab[1] %}
-  {% assign tabFile=thisTab[2] %}
-  {% assign tabGHLink=thisTab[3] %}
-  <div id="{{ thisTab[0] | strip | handleize }}">
-  {% include code.html language=tabLang file=tabFile ghlink=tabGHLink %}
-  </div>
-  {% endfor %}
-</div>
@@ -0,0 +1,15 @@
+{% comment %} See /docs/tabs-example.md for usage example. {% endcomment %}
+{% assign tab_set_id = tab_set_name | default: "tabset" | slugify %}
+<div id="{{tab_set_id}}">
+    <ul>
+{% for name in tab_names %}
+        <li><a href="#{{tab_set_id}}-{{forloop.index0}}">{{ name | strip }}</a></li>
+{% endfor %}
+    </ul>
+{% for content in tab_contents %}
+    <div id="{{tab_set_id}}-{{forloop.index0}}">
+    {{ content | markdownify }}
+    </div>
+{% endfor %}
+</div>
+<script>$(function(){$("#{{tab_set_id}}").tabs();});</script>
@@ -1,121 +0,0 @@
-{% if page.cards %}<!-- check for this before going any further; if not present, skip to else at bottom -->
-<style>
-h2, h3, h4 {
-  border-bottom: 0px !important;
-  font-size: 22px !important;
-  padding-bottom: 20px !important;
-}
-.colContainer {
-  padding-top:2px;
-  padding-left: 2px;
-  overflow: auto;
-}
-#samples a {
-  color: #000;
-}
-.col3rd {
-  display: block;
-  float: left;
-  margin-right: 30px;
-  margin-bottom: 30px;
-  overflow: hidden;
-}
-.col3rd h3, .col2nd h3 {
-  margin-bottom: 0px !important;
-}
-.col3rd .button, .col2nd .button {
-  margin-top: 20px;
-  border-radius: 2px;
-}
-.col3rd p, .col2nd p {
-  margin-left: 2px;
-}
-.col2nd {
-  display: block;
-  width: 400px;
-  float: left;
-  margin-right: 30px;
-  margin-bottom: 30px;
-  overflow: hidden;
-}
-.shadowbox {
-  width: 250px;
-  display: inline;
-  float: left;
-  text-transform: none;
-  font-weight: bold;
-  text-overflow: ellipsis;
-  overflow: hidden;
-  line-height: 24px;
-  position: relative;
-  display: block;
-  cursor: pointer;
-  box-shadow: 0 2px 2px rgba(0,0,0,.24),0 0 2px rgba(0,0,0,.12);
-  border-radius: 5px;
-  background: #fff;
-  transition: all .3s;
-  padding: 16px;
-  margin: 0 16px 16px 0;
-  text-decoration: none;
-  letter-spacing: .01em;
-  height: 220px;
-}
-.shadowbox img {
-    min-width: 100px;
-    max-width: 100px;
-    max-height: 50px;
-    margin-right: 5px;
-    margin-bottom: 5px;
-    float: left;
-}
-</style>
-
-<div class="colContainer">
-{% for card in page.cards %}{% if card.title %}
-  <div class="col3rd shadowbox">
-    <h3>{{card.title}}</h3>
-    <p>{% if card.image %}<img src="{{card.image}}">{% endif %}{{card.description}}</p>
-  </div>
-{% endif %}{% endfor %}
-</div>
-
-{% else %}
-
-### ERROR: You must define "cards" front-matter YAML
-{: style="color:red" }
-
-This template requires that you insert YAML at the top of your document
-that defines the "cards" you'd like to display on the page. The cards will
-render in clickable boxes. 
-
-To get rid of this message and take advantage of this template, define `cards`:
-
-```yaml
---
-cards:
- progression: no
- card:
-  title: Mean Stack
-  image: /docs/meanstack/image_0.png
-  description: Lorem ipsum dolor it verberum.
- card:
-  title: Guestbook + Redis
-  image: /images/docs/redis.svg
-  description: Lorem ipsum dolor it verberum.
- card:
-  title: Cloud Native Cassandra
-  image: /images/docs/cassandra.svg
-  description: Lorem ipsum dolor it verberum.
- card:
-  title: WordPress + MySQL
-  image: /images/docs/wordpress.svg
-  description: Lorem ipsum dolor it verberum. 
---
-```
-
-**Note:** If `progression` is set to `yes` then a "Start Here!" icon will be
-placed on the first card and arrows suggesting linear reading will be overlayed
-between the other cards, telling the reader that they should explore the content
-in a certain order. 
-
-{% endif %}
@@ -4,8 +4,8 @@
 <tr>
  <td>
  <p><b>NOTICE</b></p>
-  <p>As of March 14, 2017, the Kubernetes SIG-Docs-Maintainers group have begun migration of the User Guide content as announced previously to the <a href="https://github.com/kubernetes/community/tree/master/sig-docs">SIG Docs community</a> through the <a href="https://groups.google.com/forum/#!forum/kubernetes-sig-docs">kubernetes-sig-docs</a> group and <a href="https://kubernetes.slack.com/messages/sig-docs/">kubernetes.slack.com #sig-docs</a> channel.</p>
-  <p>The user guides within this section are being refactored into topics within Tutorials, Tasks, and Concepts. Anything that has been moved will have a notice placed in its previous location as well as a link to its new location. The reorganization implements the table of contents (ToC) outlined in the <a href="https://docs.google.com/a/google.com/document/d/18hRCIorVarExB2eBVHTUR6eEJ2VVk5xq1iBmkQv8O6I/edit?usp=sharing">kubernetes-docs-toc</a> document and should improve the documentation's findability and readability for a wider range of audiences.</p>
+  <p>As of March 14, 2017, the Kubernetes SIG-Docs-Maintainers group have begun migration of the User Guide content as announced previously to the <a href="https://git.k8s.io/community/sig-docs">SIG Docs community</a> through the <a href="https://groups.google.com/forum/#!forum/kubernetes-sig-docs">kubernetes-sig-docs</a> group and <a href="https://kubernetes.slack.com/messages/sig-docs/">kubernetes.slack.com #sig-docs</a> channel.</p>
+  <p>The user guides within this section are being refactored into topics within Tutorials, Tasks, and Concepts. Anything that has been moved will have a notice placed in its previous location as well as a link to its new location. The reorganization implements a new table of contents and should improve the documentation's findability and readability for a wider range of audiences.</p>
  <p>For any questions, please contact: <a href="mailto:kubernetes-sig-docs@googlegroups.com">kubernetes-sig-docs@googlegroups.com</a></p>
  </td>
 </tr>
@@ -1,4 +1,4 @@
-
+<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
@@ -1,4 +1,4 @@
-
+<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
@@ -1,4 +1,4 @@
-
+<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
@@ -1,4 +1,4 @@
-
+<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
@@ -1,4 +1,4 @@
-
+<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
@@ -1,4 +1,4 @@
-
+<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
@@ -3557,14 +3557,14 @@ Populated by the system when a graceful deletion is requested. Read-only. More i
 <tbody>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">postStart</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">PostStart is called immediately after a container is created. If the handler fails, the container is terminated and restarted according to its restart policy. Other management of the container blocks until the hook completes. More info: <a href="http://kubernetes.io/docs/user-guide/container-environment#hook-details">http://kubernetes.io/docs/user-guide/container-environment#hook-details</a></p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">PostStart is called immediately after a container is created. If the handler fails, the container is terminated and restarted according to its restart policy. Other management of the container blocks until the hook completes. More info: <a href="http://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks#hook-details">http://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks#hook-details</a></p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_handler">v1.Handler</a></p></td>
 <td class="tableblock halign-left valign-top"></td>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">preStop</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">PreStop is called immediately before a container is terminated. The container is terminated after the handler completes. The reason for termination is passed to the handler. Regardless of the outcome of the handler, the container is eventually terminated. Other management of the container blocks until the hook completes. More info: <a href="http://kubernetes.io/docs/user-guide/container-environment#hook-details">http://kubernetes.io/docs/user-guide/container-environment#hook-details</a></p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">PreStop is called immediately before a container is terminated. The container is terminated after the handler completes. The reason for termination is passed to the handler. Regardless of the outcome of the handler, the container is eventually terminated. Other management of the container blocks until the hook completes. More info: <a href="http://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks#hook-details">http://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks#hook-details</a></p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_handler">v1.Handler</a></p></td>
 <td class="tableblock halign-left valign-top"></td>
@@ -1,4 +1,4 @@
-
+<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
@@ -1,4 +1,4 @@
-
+<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
@@ -1,4 +1,4 @@
-
+<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
@@ -22,15 +22,12 @@
  <h5>{{ toc.abstract }}</h5>
  <div id="vendorStrip" class="light-text">
    <ul>
-      <li><a href="/docs/" {% if toc.bigheader == "Kubernetes Documentation" %}class="YAH"{% endif %}>DOCS HOME</a></li>
-      <li><a href="/docs/user-guide/" {% if toc.bigheader == "Guides" %}class="YAH"{% endif %}>GUIDES</a></li>
-      <li><a href="/docs/tutorials/" {% if toc.bigheader == "Tutorials" %}class="YAH"{% endif %}>TUTORIALS</a></li>
-      <li><a href="/docs/tasks/" {% if toc.bigheader == "Tasks" %}class="YAH"{% endif %}>TASKS</a></li>
+      <li><a href="/docs/home/" {% if toc.bigheader == "Kubernetes Documentation" %}class="YAH"{% endif %}>HOME</a></li>
+      <li><a href="/docs/setup/" {% if toc.bigheader == "Setup" %}class="YAH"{% endif %}>SETUP</a></li>
      <li><a href="/docs/concepts/" {% if toc.bigheader == "Concepts" %}class="YAH"{% endif %}>CONCEPTS</a></li>
+      <li><a href="/docs/tasks/" {% if toc.bigheader == "Tasks" %}class="YAH"{% endif %}>TASKS</a></li>
+      <li><a href="/docs/tutorials/" {% if toc.bigheader == "Tutorials" %}class="YAH"{% endif %}>TUTORIALS</a></li>
      <li><a href="/docs/reference/" {% if toc.bigheader == "Reference Documentation" %}class="YAH"{% endif %}>REFERENCE</a></li>
-      <li><a href="/docs/tools/" {% if toc.bigheader == "Tools" %}class="YAH"{% endif %}>TOOLS</a></li>
-      <li><a href="/docs/samples/" {% if toc.bigheader == "Samples" %}class="YAH"{% endif %}>SAMPLES</a></li>
-      <li><a href="/docs/troubleshooting/" {% if toc.bigheader == "Support" %}class="YAH"{% endif %}>SUPPORT</a></li>
    </ul>
    <div id="searchBox">
      <input type="text" id="search" placeholder="Search" onkeydown="if (event.keyCode==13) window.location.replace('/docs/search/?q=' + this.value)" autofocus="autofocus">
@@ -41,9 +38,7 @@
 <section id="encyclopedia">
  <div id="docsToc">
        <div class="pi-accordion">
-        {% if toc.bigheader != "Kubernetes Documentation" %}
          {% include_cached tree.html tree=toc.toc %}
-        {% endif %}
        </div> <!-- /pi-accordion -->
    <button class="push-menu-close-button" onclick="kub.toggleToc()"></button>
  </div> <!-- /docsToc -->
@@ -69,7 +64,7 @@
            (function(d,c,j){if(!document.getElementById(j)){var pd=d.createElement(c),s;pd.id=j;pd.src=('https:'==document.location.protocol)?'https://polldaddy.com/js/rating/rating.js':'http://i0.poll.fm/js/rating/rating.js';s=document.getElementsByTagName(c)[0];s.parentNode.insertBefore(pd,s);}}(document,'script','pd-rating-js'));
        </script>
        <a href="" onclick="window.open('https://github.com/kubernetes/kubernetes.github.io/issues/new?title=Issue%20with%20' +
-        window.location.pathname)" class="button issue">Create an Issue</a>
+        'k8s.io'+window.location.pathname)" class="button issue">Create an Issue</a>
        <a href="/editdocs#{{ page.path }}" class="button issue">Edit this Page</a>
    {% endif %}
    </div>
@@ -864,6 +864,9 @@ dd
 		font-size: inherit
 		background-color: transparent

+	.includecode
+		table-layout: fixed
+
 	.includecode, .includecode th, .includecode td
 		padding: 0 !important

@@ -965,8 +968,8 @@ dd
 		//font-weight: 700
 		text-decoration: underline

-	a:visited
-		color: blueviolet
+//	a:visited
+//		color: blueviolet

 	a.button
 		border-radius: 2px
@@ -1302,6 +1305,270 @@ $feature-box-div-margin-bottom: 40px
 			width: 100%
 			height: 100%

+// Dialog
+.ui-icon
+	display: inline-block !important
+
+#feature-state-dialog-link
+	text-decoration: none !important
+	padding: 5px !important
+	a:visited
+		color: #454545 !important
+	a code
+		display: inline-block !important
+		box-sizing: border-box !important
+		background-color: #f7f7f7 !important
+		color: #303030 !important
+		font-family: "Roboto Mono", monospace !important
+		vertical-align: baseline !important
+		font-size: 14px !important
+		font-weight: bold !important
+		padding: 0px 4px !important
+
+#feature-state-dialog
+	background: #fff !important
+	border: 1px solid #ddd !important
+	padding: 0.5em 1em !important
+
+	ul, li
+		list-style: disc !important
+		margin: 4px 12px !important
+
+	p
+		margin: 8px 0px !important
+
+	code
+		display: inline-block !important
+		box-sizing: border-box !important
+		background-color: #f7f7f7 !important
+		color: #303030 !important
+		font-family: "Roboto Mono", monospace !important
+		vertical-align: baseline !important
+		font-size: 14px !important
+		font-weight: bold !important
+		padding: 0px 4px !important
+
+.ui-dialog
+	background: #f7f7f7 !important
+	padding: 0.5em
+
+.ui-dialog-content
+	position: relative
+	float: right
+	width: 100%
+
+	$toc-margin: 15px
+	$header-clearance: $header-height + 20px
+
+	* + h2, * + h3, * + h4, * + h5, * + h6
+		margin-top: 30px
+
+	h1, h2, h3, h4, h5, h6
+		line-height: normal
+		font-weight: 500
+		margin-bottom: 30px
+		padding-bottom: 10px
+
+		// Make sure anchor links aren't hidden by the header
+		&:before
+			display: block
+			content: " "
+			margin-top: -$header-clearance
+			height: $header-clearance
+			visibility: hidden
+
+	h1,h2
+		border-bottom: 1px solid #cccccc
+		
+	h1
+		font-size: 32px
+		padding-right: 60px
+
+	h2
+		font-size: 28px
+
+	h3
+		font-size: 24px
+		font-weight: 300
+		margin-bottom: 5px
+
+	h4
+		font-size: 20px
+		margin-bottom: 0px
+
+	h5, h6
+		font-size: 16px
+		font-weight: 500
+
+	p
+		font-size: 16px
+		font-weight: 300
+		line-height: 1.75em
+
+	p + p
+		margin-top: 10px
+
+	code
+		display: inline-block
+		box-sizing: border-box
+		background-color: $light-grey
+		color: $dark-grey
+		font-family: $mono-font
+		vertical-align: baseline
+		font-size: 14px
+		font-weight: bold
+		padding: 2px 4px
+
+	a code
+		color: $blue
+		text-decoration: underline
+
+	pre .pi, pre .s
+		margin: 0
+		padding: 0
+
+	.highlight code span, code, pre code
+		font-family: "Roboto Mono", monospace
+
+	code, pre code
+		color: #303030
+
+	pre code
+		padding: 0
+
+	pre
+		background-color: #f7f7f7
+		display: block
+		margin: 20px 0
+		padding: 15px
+		position: relative
+		overflow-x: auto
+
+	h1 code, h2 code, h3 code, h4 code, h5 code, h6 code
+		font-family: inherit
+		font-size: inherit
+		background-color: transparent
+
+	.includecode
+		table-layout: fixed
+
+	.includecode, .includecode th, .includecode td
+		padding: 0 !important
+
+	.includecode th
+		text-align: right !important
+		padding: 10px !important
+
+	.includecode th a, .includecode th a code
+		color: white !important
+		background-color: transparent !important
+
+	.includecode pre
+		margin: 0 !important
+
+	ul li
+		list-style: disc
+
+	ol li
+		list-style: decimal
+
+	ul, ol
+		margin: 20px 0
+		padding-left: 30px
+		font-weight: 300
+
+	ul ul, ol ol, ul ol, ol ul
+		margin: 0.75em 0
+
+	li
+		margin-bottom: 0.75em
+		font-size: 16px
+		line-height: 1.75em
+
+	table
+		width: 100%
+		border: 1px solid #ccc
+		border-spacing: 0
+		margin-top: 30px
+		margin-bottom: 30px
+
+	thead, tr:nth-child(even)
+		background-color: $light-grey
+
+	thead
+		background-color: #555
+		color: white
+
+	th, td
+		padding: 8px
+		text-align: left
+		margin: 0
+
+	th
+		font-weight: normal
+
+	td
+		font-size: 0.85em
+
+	#editPageButton
+		position: absolute
+		top: -25px
+		right: 5px
+		width: 50px
+		height: 50px
+		line-height: 50px
+		border-radius: 50%
+		white-space: nowrap
+		text-indent: 50px
+		overflow: hidden
+		background: $blue url(/images/icon-pencil.svg) no-repeat
+		background-position: 12px 10px
+		background-size: 29px 29px
+
+	#markdown-toc
+		margin-bottom: 20px
+
+		ul, li
+			list-style: disc
+			color: $blue
+
+		ul
+			padding: 0 15px
+			margin: 0
+
+		li
+			padding: 0
+			line-height: 1.5em
+			margin-bottom: 0
+
+		a
+			position: relative
+			color: $blue
+			font-weight: 700
+
+	img
+		max-width: 100%
+
+	a
+		//font-weight: 700
+		text-decoration: underline
+
+//	a:visited
+//		color: blueviolet
+
+	a.button
+		border-radius: 2px
+		text-decoration: none
+		
+		&:visited
+			color: white
+
+	a.issue
+		margin-left: 0px
+
+.ui-dialog-buttonpane
+	background: #f7f7f7 !important
+
 // Tabs
 .ui-widget-header
 	background: transparent !important
@@ -1313,19 +1580,27 @@ $feature-box-div-margin-bottom: 40px
 		padding: 0px !important
 		list-style: none !important
 		margin-bottom: 0px !important
-		margin-left: 1px !important
+		margin-left: 4px !important
+
+.ui-tabs-panel
+	ul li
+		list-style: disc !important
+
+	ol li
+		list-style: decimal !important

 .ui-widget-content
 	border: 0px !important

-.ui-widget-content
 	table
 		margin: 0px !important

 .ui-tabs .ui-tabs-panel
-	padding: 0px !important
 	border: 1px solid #ccc !important

+.ui-tabs-anchor
+	text-decoration: none !important
+
 // Talk to us
 #talkToUs
 	h3, h4
@@ -0,0 +1,18 @@
+## 如何参与 Kubernetes 文档汉化工作
+
+我们非常欢迎，非常希望您参与 Kubernetes 文档汉化做出贡献。
+
+您可以单击屏幕右上角的 **Fork** 按钮，在您的 Github 账户中创建一外名为 *fork* 的存储库副本。在您的分支中进行更改，当您准备好将这些更改发送给我们时，请转到您的仓库创建新的 pull 请求，让我们知道这一点。
+
+关于更多的贡献信息，请参阅:
+
+* [贡献于 Kubernetes 文档](http://kubernetes.io/editdocs/)
+* [创建文档拉取请求](http://kubernetes.io/docs/contribute/create-pull-request/)
+* [写一个新的话题](http://kubernetes.io/docs/contribute/write-new-topic/)
+* [暂停您的文档更改](http://kubernetes.io/docs/contribute/stage-documentation-changes/)
+* [更用页面模板](http://kubernetes.io/docs/contribute/page-templates/)
+* [文档样式指南](http://kubernetes.io/docs/contribute/style-guide/)
+
+## 谢谢您!
+
+Kubernetes 在社区参与中茁壮成长，我们非常感谢您对我们的网站和文档的贡献！
@@ -0,0 +1,2 @@
+Kubernetes 文档的 [用户指南](/docs/user-guide/) 部分中的主题将被移动到 [任务](/docs/tasks/)、[教程](/docs/tutorials/)和
+[概念](/docs/concepts) 部分。 本主题的内容已转移到:
@@ -0,0 +1,119 @@
+---
+assignees:
+- k8s-merge-robot
+
+title: 认识 Kubernetes?
+---
+
+Kubernetes 是一个 [开源的容器调度平台，它可以自动化应用容器的部署、扩展和操作](http://www.slideshare.net/BrianGrant11/wso2con-us-2015-kubernetes-a-platform-for-automating-deployment-scaling-and-operations) 可以跨主机集群, 提供以容器为中心的基础架构。
+
+使用 Kubernetes, 您可以快速高效地响应客户需求:
+
+ - 快速、可预测地部署您的应用程序
+ - 拥有即时扩展应用程序的能力
+ - 不影响现有业务的情况下，无缝地发布新功能。
+ - 优化您的硬件资源，降低您的拥有成本
+
+我们的目标是构建一个软件和工具的生态系统，以减轻您在公共云或私有云运行应用程序的负担。
+
+#### Kubernetes 具有如下特点:
+
+* **便携性**: 无论公有云、私有云、混合云还是多云架构都全面支持
+* **可扩展**: 它是模块化、可插拔、可挂载、可组合的，支持各种形式的扩展
+* **自修复**: 它可以自保持应用状态、可自重启、自复制、自缩放的，通过声明式语法提供了强大的自修复能力
+
+Kubernetes 项目由 Google 公司在 2014 年启动。Kubernetes 建立在 [Google 公司超过十余年的运维经验基础之上，Google 所有的应用都运行在容器上](https://research.google.com/pubs/pub43438.html), 再与社区中最好的想法和实践相结合，也许它是最受欢迎的容器平台。
+
+##### 准备好 [开始](/docs/getting-started-guides/)?
+
+## 为什么是容器?
+
+查看此文，可以了解为什么您要使用容器 [容器](http://aucouranton.com/2014/06/13/linux-containers-parallels-lxc-openvz-docker-and-more/)?
+
+![为什么是容器?](/images/docs/why_containers.svg)
+
+*传统* 部署应用程序的方式，一般是使用操作系统自带的包管理器在主机上安装应用依赖，之后再安装应用程序。这无疑将应用程序的可执行文件、应用的配置、应用依赖库和应用的生命周期与宿主机操作系统进行了紧耦合。在此情境下，可以通过构建不可改变的虚拟机镜像版本，通过镜像版本实现可预测的发布和回滚，但是虚拟机实在是太重量级了，且镜像体积太庞大，便捷性差。
+
+*新方式* 是基于操作系统级虚拟化而不是硬件级虚拟化方法来部署容器。容器之间彼此隔离并与主机隔离：它们具有自己的文件系统，不能看到彼此的进程，并且它们所使用的计算资源是可以被限制的。它们比虚拟机更容易构建，并且因为它们与底层基础架构和主机文件系统隔离，所以它们可以跨云和操作系统快速分发。
+
+由于容器体积小且启动快，因此可以在每个容器镜像中打包一个应用程序。这种一对一的应用镜像关系拥有很多好处。使用容器，不需要与外部的基础架构环境绑定, 因为每一个应用程序不需要外部依赖，更不需要与外部的基础架构环境依赖。完美解决了从开发到生产环境的一致性问题。
+
+类似地，容器比虚拟机更加透明，这有助于监测和管理。真实的情况是，容器进程的生命周期由基础设施管理，而容器内的进程对外是隐藏的。最后，每个应用程序用容器封装，管理容器部署就等同于管理应用程序部署。
+
+容器好处摘要:
+
+* **敏捷的应用程序创建和部署**:
+    与虚拟机镜像相比，容器镜像更容易创建，提升了硬件的使用效率。
+* **持续开发、集成和部署**:
+    提供可靠与频繁的容器镜像构建和部署，可以很方便及快速的回滚 (由于镜像不可变性).
+* **关注开发与运维的分离**:
+    在构建/发布时创建应用程序容器镜像，从而将应用程序与基础架构分离。
+* **开发、测试和生产环境的一致性**:
+    在笔记本电脑上运行与云中一样。
+* **云和操作系统的可移植性**:
+    可运行在 Ubuntu, RHEL, CoreOS, 内部部署, Google 容器引擎和其他任何地方。
+* **以应用为中心的管理**:
+    提升了操作系统的抽象级别，以便在使用逻辑资源的操作系统上运行应用程序。
+* **松耦合、分布式、弹性伸缩 [微服务](http://martinfowler.com/articles/microservices.html)**:
+    应用程序被分成更小，更独立的部分，可以动态部署和管理 - 而不是巨型单体应用运行在专用的大型机。
+* **资源隔离**:
+    通过对应用进行资源隔离，可以很容易的预测应用程序性能。
+* **资源利用**:
+    高效率和高密度。
+
+#### 为什么我们需要 Kubernetes，它能做什么?
+
+最基础的，Kubernetes 可以在物理或虚拟机集群上调度和运行应用程序容器。然而，Kubernetes 还允许开发人员从物理和虚拟机'脱离'，从以**主机为中心**的基础架构转移到以**容器为中心**的基础架构，这样可以提供容器固有的全部优点和益处。Kubernetes 提供了基础设施来构建一个真正以**容器为中心**的开发环境。
+
+Kubernetes 满足了生产中运行应用程序的许多常见的需求，例如：
+
+* [Pod](/docs/user-guide/pods/) 提供复合应用并保留一个应用一个容器的容器模型,
+* [挂载外部存储](/docs/user-guide/volumes/),
+* [Secret管理](/docs/user-guide/secrets/),
+* [应用健康检查](/docs/user-guide/production-pods/#liveness-and-readiness-probes-aka-health-checks),
+* [副本应用实例](/docs/user-guide/replication-controller/),
+* [横向自动扩缩容](/docs/user-guide/horizontal-pod-autoscaling/),
+* [服务发现](/docs/user-guide/connecting-applications/),
+* [负载均衡](/docs/user-guide/services/),
+* [滚动更新](/docs/user-guide/update-demo/),
+* [资源监测](/docs/user-guide/monitoring/),
+* [日志采集和存储](/docs/user-guide/logging/overview/),
+* [支持自检和调试](/docs/user-guide/introspection-and-debugging/),
+* [认证和鉴权](/docs/admin/authorization/).
+
+这提供了平台即服务 (PAAS) 的简单性以及基础架构即服务 (IAAS) 的灵活性，并促进跨基础设施供应商的可移植性。
+
+有关详细信息，请参阅 [用户指南](/docs/user-guide/).
+
+#### 为什么 Kubernetes 是一个平台?
+
+Kubernetes 提供了很多的功能，总会有新的场景会受益于新特性。它可以简化应用程序的工作流，加快开发速度。被大家认可的应用编排通常需要有较强的自动化能力。这就是为什么 Kubernetes 被设计作为构建组件和工具的生态系统平台，以便更轻松地部署、扩展和管理应用程序。
+
+[Label](/docs/user-guide/labels/) 允许用户按照自己的方式组织管理对应的资源。 [注解](/docs/user-guide/annotations/) 使用户能够以自定义的描述信息来修饰资源，以适用于自己的工作流，并为管理工具提供检查点状态的简单方法。
+
+此外，[Kubernetes 控制面](/docs/admin/cluster-components) 是构建在相同的 [APIs](/docs/api/) 上面，开发员人和用户都可以用。用户可以编写自己的控制器， [调度器](https://git.k8s.io/community/contributors/devel/scheduler.md)等等，如果这么做，根据新加的[自定义 API](https://git.k8s.io/community/contributors/design-proposals/extending-api.md) ，可以扩展当前的通用 [CLI 命令行工具](/docs/user-guide/kubectl-overview/)。
+
+这种 [设计](https://git.k8s.io/community/contributors/design-proposals/principles.md) 使得许多其他系统可以构建在 Kubernetes 之上。
+
+#### Kubernetes 不是什么:
+
+Kubernetes 不是一个传统意义上，包罗万象的 PaaS (平台即服务) 系统。我们保留用户选择的自由，这非常重要。
+
+* Kubernetes 不限制支持的应用程序类型。 它不插手应用程序框架 (例如 [Wildfly](http://wildfly.org/)), 不限制支持的语言运行时 (例如 Java, Python, Ruby)，只迎合符合 [12种因素的应用程序](http://12factor.net/)，也不区分"应用程序"与"服务"。Kubernetes 旨在支持极其多样化的工作负载，包括无状态、有状态和数据处理工作负载。如果应用可以在容器中运行，它就可以在 Kubernetes 上运行。
+* Kubernetes 不提供作为内置服务的中间件 (例如 消息中间件)、数据处理框架 (例如 Spark)、数据库 (例如 mysql)或集群存储系统 (例如 Ceph)。这些应用可以运行在 Kubernetes 上。
+* Kubernetes 没有提供点击即部署的服务市场
+* Kubernetes 从源代码到镜像都是非垄断的。 它不部署源代码且不构建您的应用程序。 持续集成 (CI) 工作流是一个不同用户和项目都有自己需求和偏好的领域。 所以我们支持在 Kubernetes 分层的 CI 工作流，但不指定它应该如何工作。
+* Kubernetes 允许用户选择其他的日志记录，监控和告警系统 (虽然我们提供一些集成作为概念验证)
+* Kubernetes 不提供或授权一个全面的应用程序配置语言/系统 (例如 [jsonnet](https://github.com/google/jsonnet)).
+* Kubernetes 不提供也不采用任何全面机器配置、保养、管理或自我修复系统
+
+另一方面，许多 PaaS 系统*运行*在 Kubernetes 上面，例如  [Openshift](https://github.com/openshift/origin), [Deis](http://deis.io/), and [Eldarion](http://eldarion.cloud/)。 您也可以自定义您自己的 PaaS, 与您选择的 CI 系统集成，或与 Kubernetes 一起使用: 将您的容器镜像部署到 Kubernetes。
+
+由于 Kubernetes 在应用级别而不仅仅在硬件级别上运行，因此它提供 PaaS 产品通用的一些功能，例如部署、扩展、负载均衡、日志记录、监控等。但是，Kubernetes 不是单一的，默认解决方案是可选和可插拔的。
+
+此处，Kubernetes 不仅仅是一个 "编排系统"；它消除了编排的需要。 "编排"技术定义的是工作流的执行: 从 A 到 B，然后到 C。相反，Kubernetes 是包括一套独立、可组合的控制过程，通过声明式语法使其连续地朝着期望状态驱动当前状态。 不需要告诉它具体从 A 到 C 的过程，只要告诉到 C 的状态即可。 也不需要集中控制；该方法更类似于"编舞"。这使得系统更容易使用并且更强大、更可靠、更具弹性和可扩展性。
+
+#### *Kubernetes* 是什么意思? K8s?
+
+名称 **Kubernetes** 源于希腊语，意为 "舵手" 或 "飞行员"， 且是英文 "governor" 和 ["cybernetic"](http://www.etymonline.com/index.php?term=cybernetics)的词根。 **K8s** 是通过将 8 个字母 "ubernete" 替换为 8 而导出的缩写。另外，在中文里，k8s 的发音与 Kubernetes 的发音比较接近。
+
@@ -0,0 +1,35 @@
+---
+title: 交互式教程 - 创建集群
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+<script src="https://katacoda.com/embed.js"></script>
+
+<div class="layout" id="top">
+
+    <main class="content katacoda-content">
+
+        <div class="katacoda">
+            <div class="katacoda__alert">
+                To interact with the Terminal, please use the desktop/tablet version
+            </div>
+            <div class="katacoda__box" id="inline-terminal-1"  data-katacoda-id="kubernetes-bootcamp/1" data-katacoda-color="326de6" data-katacoda-secondary="273d6d" data-katacoda-hideintro="false" data-katacoda-font="Roboto" data-katacoda-fontheader="Roboto Slab" data-katacoda-prompt="Kubernetes Bootcamp Terminal" style="height: 600px;"></div>
+        </div>
+        <div class="row">
+            <div class="col-md-12">
+                <a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/deploy-intro/" role="button">Continue to Module 2<span class="btn__next">›</span></a>
+            </div>
+        </div>
+
+    </main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,110 @@
+---
+redirect_from:
+- "/docs/tutorials/getting-started/create-cluster/"
+- "/docs/tutorials/getting-started/create-cluster.html"
+title: 使用 Minikube 创建一个集群
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+
+<div class="layout" id="top">
+
+	<main class="content">
+
+		<div class="row">
+
+      <div class="col-md-8">
+      	<h3>目标</h3>
+				<ul>
+					<li>了解什么是 Kubernetes 集群</li>
+					<li>了解什么是 Minikube</li>
+					<li>使用在线终端启动 Kubernetes 集群</li>
+				</ul>
+			</div>
+
+			<div class="col-md-8">
+				<h3>Kubernetes 集群</h3>
+				<p>
+				<b>Kubernetes 用于协调高度可用的计算机集群，这些计算机群集被连接作为单个单元工作。</b> Kubernetes 中的抽象允许您将容器化的应用程序部署到集群，而不必专门将其绑定到单个计算机。为了利用这种新的部署模型，应用程序需要以将它们与各个主机分离的方式打包: 它们需要被容器化。容器化应用程序比过去的部署模型更灵活和可用，其中应用程序直接安装到特定机器上，作为深入集成到主机中的软件包。 <b>Kubernetes 以更有效的方式自动化、跨集群的容器应用程序的分发和调度。</b> Kubernetes 是一个 <a href="https://github.com/kubernetes/kubernetes">开源</a> 平台，为生产环境准备的。
+				</p>
+				<p>Kubernetes 集群由两种类型的资源组成:
+					<ul>
+			            <li>一个 <b>Master</b> 调度节点</li>
+			            <li><b>Nodes</b> 应用程序实际运行的地方</li>
+			        </ul>
+			    </p>
+			</div>
+
+			<div class="col-md-4">
+				<div class="content__box content__box_lined">
+					<h3>概要:</h3>
+					<ul>
+						<li>Kubernetes 集群</li>
+						<li>Minikube</li>
+					</ul>
+				</div>
+				<div class="content__box content__box_fill">
+					<p><i>
+						Kubernetes 是一个生产级的开源平台，用于协调计算机集群内部和跨计算机集群的应用程序容器的分发(调度)和运行。
+					</i></p>
+				</div>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<h2 style="color: #3771e3;">集群图</h2>
+			</div>
+		</div>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p><img src="/docs/tutorials/kubernetes-basics/public/images/module_01_cluster.svg"></p>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p><b>Master 负责管理集群。</b> master 协调集群中的所有活动，例如调度应用程序、维护应用程序的所需状态、扩展应用程序和滚动更新。</p>
+				<p><b>node 是 Kubernetes 集群中的工作机器，可以是物理机或虚拟机。</b> 每个工作节点都有一个 Kubelet，它是管理 node 并与 Kubernetes Master 节点进行通信的代理。node 上还应具有处理容器操作的工作，例如 <a href="https://www.docker.com/">Docker</a> 或 <a href="https://coreos.com/rkt/">rkt</a>。一个 Kubernetes 工作集群至少有三个 node 节点。</p>
+
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_fill">
+					<p><i> Master 管理集群和 Nodes 用于托管正在运行的应用程序。  </i></p>
+				</div>
+			</div>
+		</div>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p>当您在 Kubernetes 上部署应用程序时，您可以告诉 master 启动应用程序容器。Master 调度容器在集群的 Node 上运行。<b> Nodes 使用 Master 公开的 Kubernetes API 与 Master 通信</b>。最终用户还可以直接使用 Kubernetes 的 API 与集群交互。</p>
+
+				<p>Kubernetes 集群可以部署在物理机或虚拟机上。要开始使用 Kubernetes 开发，您可以使用 <a href="https://github.com/kubernetes/minikube">Minikube</a>。Minikube 是一个轻量级的 Kubernetes 实现，在本机创建一台虚拟机，并部署一个只包含一个节点的简单集群。 Minikube 适用于 Linux, Mac OS 和 Windows 系统。Minikube CLI 提供了集群的基本引导操作，包括启动、停止、状态和删除。但是，对于此基础训练，您将使用预先安装了 Minikube 的在线终端。</p>
+
+				<p>现在您已经知道 Kubernetes 是什么，让我们使用在线教程，开始我们的第一个集群!</p>
+
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-12">
+				<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/cluster-interactive/" role="button">启动交互教程 <span class="btn__next">›</span></a>
+			</div>
+		</div>
+
+	</main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,39 @@
+---
+title: 交互式教程 - 部署应用程序
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+<script src="https://katacoda.com/embed.js"></script>
+
+<div class="layout" id="top">
+
+    <main class="content katacoda-content">
+
+        <br>
+        <div class="katacoda">
+            <div class="katacoda__alert">
+                To interact with the Terminal, please use the desktop/tablet version
+            </div>
+
+            <div class="katacoda__box" id="inline-terminal-1"  data-katacoda-id="kubernetes-bootcamp/7" data-katacoda-color="326de6" data-katacoda-secondary="273d6d" data-katacoda-hideintro="false" data-katacoda-font="Roboto" data-katacoda-fontheader="Roboto Slab" data-katacoda-prompt="Kubernetes Bootcamp Terminal" style="height: 600px;">
+            </div>
+
+        </div>
+        <div class="row">
+            <div class="col-md-12">
+                <a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/explore-intro/" role="button">Continue to Module 3<span class="btn__next">›</span></a>
+            </div>
+        </div>
+
+    </main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,108 @@
+---
+title: 使用 kubectl 创建部署
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+
+<div class="layout" id="top">
+
+	<main class="content">
+
+		<div class="row">
+
+		 <div class="col-md-8">
+      	<h3>目标</h3>
+				<ul>
+					<li>了解应用程序部署</li>
+					<li>使用 kubectl 在 Kubernetes 上部署您的第一个应用程序</li>
+				</ul>
+			</div>
+
+			<div class="col-md-8">
+				<h3>Kubernetes 部署</h3>
+				<p>
+				一旦运行了 Kubernetes 集群，您可以在其上部署容器化应用程序。为此，您可以创建一个 Kubernetes <b>Deployment</b>。Deployment 负责创建和更新应用程序实例。创建 Deployment 后， Kubernetes master 会将 Deployment 创建的应用程序实例调度到集群中的各个节点。
+				</p>
+
+				<p>创建应用程序实例后，Kubernetes Deployment 控制器会持续监视这些实例。如果托管它的节点不可用或删除，则 Deployment 控制器将替换实例。 <b>这提供了一种解决机器故障或维护的自愈机制。</b></p>
+
+				<p>在编排前的世界中，通常会使用安装脚本启动应用程序，但是它们并不能从机器故障中恢复。通过创建应用程序实例并使其运行在跨节点的机器之间，Kubernetes Deployments 提供了截然不同的应用管理方法。 </p>
+
+			</div>
+
+			<div class="col-md-4">
+				<div class="content__box content__box_lined">
+					<h3>概要:</h3>
+					<ul>
+						<li>Deployments</li>
+						<li>Kubectl</li>
+					</ul>
+				</div>
+				<div class="content__box content__box_fill">
+					<p><i>
+						Deployment 负责创建和更新应用程序的实例
+					</i></p>
+				</div>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<h2 style="color: #3771e3;">在 Kubernetes 上部署您的第一个应用程序</h2>
+			</div>
+		</div>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p><img src="/docs/tutorials/kubernetes-basics/public/images/module_02_first_app.svg"></p>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+
+                <p>您可以使用 Kubernetes 命令行工具 <b>Kubectl</b>创建和管理 Deployment。Kubectl 使用 Kubernetes API 与集群进行交互。在本模块中，您将学习在 Kubernetes 集群上运行应用程序部署所需的最常见 Kubectl 命令。</p>
+
+				<p>创建部署时，您需要为应用程序指定容器镜像以及要运行的副本数。您可以稍后通过更新部署来更改该信息；模块 <a href="/docs/tutorials/kubernetes-basics/scale-intro/">5</a> 和 <a href="/docs/tutorials/kubernetes-basics/update-intro/">6</a> 是一个基础训练讨论如何扩展和更新您的部署。</p>
+
+
+
+
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_fill">
+					<p><i> 应用程序需要打包成支持的容器格式之一，以便部署在 Kubernetes 上。</i></p>
+				</div>
+			</div>
+		</div>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p>对于我们的第一个部署，我们将使用 <a href="https://nodejs.org">Node.js</a> 应用程序打包到 Docker 容器。源代码和 Dockerfile 可在 Kubernetes Bootcamp <a href="https://github.com/kubernetes/kubernetes-bootcamp">GitHub 存储库</a> 中找到。</p>
+
+				<p>现在您已经知道部署是什么，我来再来看看在线教程，并部署我们的第一个应用程序!</p>
+
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-12">
+				<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/deploy-interactive/" role="button">启动交互式教程 <span class="btn__next">›</span></a>
+			</div>
+		</div>
+
+	</main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,39 @@
+---
+title: 交互式教程 - 应用程序探索
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+<script src="https://katacoda.com/embed.js"></script>
+
+<div class="layout" id="top">
+
+    <main class="content katacoda-content">
+
+        <br>
+        <div class="katacoda">
+
+            <div class="katacoda__alert">
+                To interact with the Terminal, please use the desktop/tablet version
+            </div>
+
+            <div class="katacoda__box" id="inline-terminal-1"  data-katacoda-id="kubernetes-bootcamp/4" data-katacoda-color="326de6" data-katacoda-secondary="273d6d" data-katacoda-hideintro="false" data-katacoda-font="Roboto" data-katacoda-fontheader="Roboto Slab" data-katacoda-prompt="Kubernetes Bootcamp Terminal" style="height: 600px;">
+            </div>
+        </div>
+        <div class="row">
+            <div class="col-md-12">
+                <a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/expose-intro/" role="button">Continue to Module 4<span class="btn__next">›</span></a>
+            </div>
+        </div>
+
+    </main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,142 @@
+---
+title: 查看 Pods 和 Nodes
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+
+
+<div class="layout" id="top">
+
+	<main class="content">
+
+		<div class="row">
+
+     <div class="col-md-8">
+      	<h3>目标</h3>
+				<ul>
+					<li>了解 Kubernetes Pods</li>
+					<li>了解 Kubernetes Nodes</li>
+					<li>已部署应用故障排除</li>
+				</ul>
+			</div>
+
+			<div class="col-md-8">
+				<h2>Kubernetes Pods</h2>
+				<p>当您在模块 <a href="/docs/tutorials/kubernetes-basics/deploy-intro/">2</a>中创建部署时，Kubernetes 创建了一个 <b>Pod</b> 来托管您的应用程序实例。Pod 是一个 Kubernetes 的资源抽象，表示一个或多个应用容器 (例如 Docker 或 rkt) 组，以及一些用于这些容器的共享资源。这些资源包括:</p>
+				<ul>
+					<li>共享存储，如卷</li>
+					<li>网络，作为唯一的集群 IP 地址</li>
+					<li>每个容器如何运行的信息，例如容器镜像版本或要使用的特定端口</li>
+				</ul>
+				<p>Pod 模型可以理解为应用程序特定的 "逻辑主机"，并且可以包含相对紧密耦合的不同应用程序容器。例如，Pod 可能包含带有 Node.js 应用程序的容器以及用于提供要由 Node.js Web 服务器发布数据的不同容器。Pod 中的容器共享 IP 地址和端口空间，始终位于同一位置并且统一调度，并在相同的节点上运行，共享上下文环境。</p>
+
+			<p>Pods 是 Kubernetes 平台上的原子单元。当我们在 Kubernetes 上创建一个部署时，该部署将在其中创建包含容器的 Pod (而不是直接创建容器)。每个 Pod 绑定到它被调度的节点，并且保持在那里，直到终止 (根据重启策略) 或删除。在节点故障的情况下，在集群中的其他可用节点上调度相同的 Pod。</p>
+
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_lined">
+					<h3>概要:</h3>
+					<ul>
+						<li>Pods</li>
+						<li>Nodes</li>
+						<li>Kubectl 主要命令</li>
+					</ul>
+				</div>
+				<div class="content__box content__box_fill">
+						<p><i>
+							Pod 是一组或多个应用程序容器 (例如 Docker 或 rkt)，包含共享存储 (卷)，IP 地址以及有关如何运行它们的信息。
+						</i></p>
+				</div>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<h2 style="color: #3771e3;">Pods 概览</h2>
+			</div>
+		</div>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p><img src="/docs/tutorials/kubernetes-basics/public/images/module_03_pods.svg"></p>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<h2>Nodes</h2>
+				<p>Pod 总是运行在 <b>Node</b>上。Node 是 Kubernetes 的工作机器，可以是一个虚拟机或物理，这取决于在集群的安装情况。每个 Node 由 Master 管理。一个 Node 上可以有多个 Pod, Kubernetes master 会自动处理调度集群各个 Node 上的 Pod。 Master 在自动调度时，会考虑每个 Node 上的可用资源。</p>
+
+				<p>每个 Kubernetes Node 节点至少运行以下组件:</p>
+				<ul>
+					<li>Kubelet 是负责 Kubernetes Master 和 所有 Node 节点之间通信的进程，它管理机器上运行的 Pod 和容器。</li>
+					<li>容器运行时(例如 Docker, rkt) 负责从镜像仓库中拉取容器镜像，解包容器并运行应用程序。</li>
+				</ul>
+
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_fill">
+					<p><i> 如果一些容器强耦合并且需要共享资源(例如 磁盘)，那么这些容器应该放到单个 Pod 中一起调度。 </i></p>
+				</div>
+			</div>
+		</div>
+
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<h2 style="color: #3771e3;">Node 概述</h2>
+			</div>
+		</div>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p><img src="/docs/tutorials/kubernetes-basics/public/images/module_03_nodes.svg"></p>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<h2>使用 kubectl 进行故障排除</h2>
+				<p>在模块 <a href="/docs/tutorials/kubernetes-basics/deploy-intro/">2</a>中，您使用了 Kubectl 命令行接口。您将在模块 3 中继续使用它来获取有关已部署应用程序及其环境信息。最常见的操作可以通过以下 kubectl 命令完成:</p>
+				<ul>
+					<li><b>kubectl get</b> - 列出可用资源</li>
+					<li><b>kubectl describe</b> - 显示有关资源的详细信息</li>
+					<li><b>kubectl logs</b> - 从 Pod 中的容器打印日志</li>
+					<li><b>kubectl exec</b> - 在 Pod 中的容器执行命令</li>
+				</ul>
+
+				<p>您可以使用这些命令来查看应用程序部署的时间，它们当前的状态，运行的位置及其配置。</p>
+
+				<p>现在我们更多地了解了集群组件和命令行交互，接下来，一起来探索分析我们的应用程序。</p>
+
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_fill">
+					<p><i> Node 是 Kubernetes 中的工作机器，可能是物理机或虚拟机，具体取决于集群的安装配置。多个 Pod 可以在一个 Node 上运行。 </i></p>
+				</div>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-12">
+				<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/explore-interactive/" role="button">启动交互式教程<span class="btn__next">›</span></a>
+			</div>
+		</div>
+
+	</main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,36 @@
+---
+title: 交互性教程 - 应用外部可见
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+<script src="https://katacoda.com/embed.js"></script>
+
+<div class="layout" id="top">
+
+    <main class="content katacoda-content">
+
+        <div class="katacoda">
+            <div class="katacoda__alert">
+                To interact with the Terminal, please use the desktop/tablet version
+            </div>
+            <div class="katacoda__box" id="inline-terminal-1"  data-katacoda-id="kubernetes-bootcamp/8" data-katacoda-color="326de6" data-katacoda-secondary="273d6d" data-katacoda-hideintro="false" data-katacoda-font="Roboto" data-katacoda-fontheader="Roboto Slab" data-katacoda-prompt="Kubernetes Bootcamp Terminal" style="height: 600px;">
+            </div>
+        </div>
+        <div class="row">
+            <div class="col-md-12">
+                <a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/scale-intro/" role="button">Continue to Module 5<span class="btn__next">›</span></a>
+            </div>
+        </div>
+
+    </main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,138 @@
+---
+title: 使用服务让您的应用程序外部可见
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+
+<div class="layout" id="top">
+
+	<main class="content">
+
+		<div class="row">
+
+     <div class="col-md-8">
+      	<h3>目标</h3>
+				<ul>
+					<li>了解 Kubernetes 服务</li>
+					<li>了解 Kubernetes 标签</li>
+					<li>应用程序在 Kubernetes 外部可见</li>
+				</ul>
+			</div>
+
+			<div class="col-md-8">
+			<h3>Kubernetes Services</h3>
+
+			<p>虽然每个 Pod 在所在的集群中拥有自己独立的 IP 地址，但这些 IP 地址不会暴露在 Kubernetes 集群外部。考虑到 Pod 可能随时会被终止、删除或被其他 Pod 替换，我们需要一种方法让其他 Pod 和应用程序自动发现彼此。Kubernetes 通过 Service 对 Pods 进行分组来解决此问题。一个 Kubernetes <b>Service</b> 是一个抽象层，它定义了一组逻辑的 Pods，并让这些 Pods 对外部流量可见，可以被负载均衡和服务发现。 </p>
+
+			<p>此抽象允许我们将 Pods 暴露给集群外部的流量访问。Services 具有自己的唯一集群专用 IP 地址，并显示一个端口以接收流量。如果选择在集群外公开 Service，则有如下选项:</p>
+			<ul>
+				<li>LoadBalancer - 提供公有 IP 地址 (在 GCP 或 AWS 上运行 Kubernetes 通常使用此方式)</li>
+				<li>NodePort - 使用 NAT 在集群的每个 Node 节点的同一端口让服务可见。(所有 Kubernetes 集群和 Minikube 中都可用此方式)</li>
+			</ul>
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_lined">
+					<h3>摘要:</h3>
+					<ul>
+						<li>Pod 流量外部可见</li>
+						<li>Pods 流量负载均衡</li>
+						<li>使用标签</li>
+					</ul>
+				</div>
+				<div class="content__box content__box_fill">
+						<p><i>
+							Kubernetes Service 是一个抽象层，它定义了一组逻辑的 Pods，并为这些 Pods 启用了外部流量访问、负载均衡和服务发现。
+						</i></p>
+				</div>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<h2 style="color: #3771e3;">Services 概述</h2>
+			</div>
+		</div>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p><img src="/docs/tutorials/kubernetes-basics/public/images/module_04_services.svg"></p>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+
+				<p>一个 Service 提供了一组 Pods 的流量负载均衡。通过创建服务以对来自特定部署的所有 Pods 进行分组时，这是有用的(当我们有多个实例运行时，我们的应用程序将在下一个模块中使用这一点)。</p>
+
+				<p>Services 还负责集群内部的服务发现 (包含在 <a href="/docs/user-guide/connecting-applications/#accessing-the-service">访问服务</a>中)。 例如，这将允许前端服务 (如 web 服务器) 从后端服务 (如 数据库) 接收流量，而不必考虑 Pod。 </p>
+
+				<p>Services 使用标签选择器匹配一组 Pods，标签选择器支持在标签上进行原始逻辑分组的能力。</p>
+
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_fill">
+					<p><i> 您可以通过添加 --expose 作为 kubectl 运行命令的参数，在创建 Deployment 的同时创建 Service。 </i></p>
+				</div>
+			</div>
+		</div>
+
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p><b>Labels</b> 是附加到对象的 键/值对，例如 Pods，您可以将它们视为社交媒体的标签符号。它们用于以对用户有意义的方式组织相关对象，如:</p>
+				<ul>
+					<li>生产环境 (生产、测试、开发)</li>
+					<li>应用程序版本 (beta、v1.3)</li>
+					<li>服务类型 (前端、后端、数据库)</li>
+				</ul>
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_fill">
+					<p><i> Labels 是附加到对象的键/值对。</i></p>
+				</div>
+			</div>
+		</div>
+		<br>
+		<div class="row">
+			<div class="col-md-8">
+				<h2 style="color: #3771e3;">Labels</h2>
+			</div>
+		</div>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p><img src="/docs/tutorials/kubernetes-basics/public/images/module_04_labels.svg"></p>
+			</div>
+		</div>
+		<br>
+		<div class="row">
+			<div class="col-md-8">
+
+				<p>Labels 可以在创建时或以后附加到对象，并可以随时修改。
+				在使用 kubectl run 命令新建 Pods/Deployment 时，会设置一些默认的 Labels/Label。标签和标签选择器之间的链接定义了 Deployment 及其创建 Pod 之间的关系。</p>
+
+				<p>现在，让我们在 Service 的帮助下公开我们的应用程序，并应用一些新的标签。</p>
+			</div>
+		</div>
+		<br>
+		<div class="row">
+			<div class="col-md-12">
+				<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/expose-interactive/" role="button">启动交互式教程<span class="btn__next">›</span></a>
+			</div>
+		</div>
+
+	</main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,106 @@
+---
+title: 概述
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="./public/css/styles.css" rel="stylesheet">
+
+<div class="layout" id="top">
+
+  <main class="content">
+
+    <div class="row">
+      <div class="col-md-9">
+        <h2>Kubernetes 基础</h2>
+        <p>本教程介绍了 Kubernetes 集群编排系统的基础知识。每个模块包含关于 Kubernetes 主要特性和概念的一些背景信息，并包括一个交互式在线教程。这些交互式教程让您可以自己管理一个简单的集群及其容器化应用程序。</p>
+        <p>使用交互式教程，您可以学习:</p>
+        <ul>
+        <li>在集群上部署容器化应用程序</li>
+        <li>弹性部署</li>
+        <li>使用新的软件版本，更新容器化应用程序</li>
+        <li>调试容器化应用程序</li>
+        </ul>
+        <p>教程 Katacoda 在您的浏览器中运行一个虚拟终端，在浏览器中运行 Minikube，这是一个可在任何地方小规模本地部署的 Kubernetes 集群。没有安装任何软件或进行任何配置; 每个交互性教程都直接从您的网页浏览器上运行。</p>
+      </div>
+    </div>
+
+    <br>
+
+    <div class="row">
+      <div class="col-md-9">
+        <h2>Kubernetes 可以为您做些什么?</h2>
+        <p>现代的 Web 服务，用户希望应用程序能够 24/7 全天候使用，开发人员希望每天可以多次发布部署新版本的应用程序。 容器化可以帮助软件包服务于这些目标，使应用程序能够以简单快速的方式发布和更新，而无需停机。Kubernetes 帮助您确保这些容器化的应用程序在您想要的地方和时间运行，并帮助应用程序找到它们需要的资源的工具。 <a href="http://kubernetes.io/docs/whatisk8s/">Kubernetes</a>  是一个生产可用的开源平台，具有 Google 容器集群方面的设计与经验积累，拥有来自社区的最佳实践。</p>
+      </div>
+    </div>
+
+    <div class="content__modules">
+      <h2>Kubernetes 基础模块</h2>
+      <div class="row">
+        <div class="col-md-4">
+          <div class="thumbnail">
+            <a href="/docs/tutorials/kubernetes-basics/cluster-intro/"><img src="./public/images/module_01.svg?v=1469803628347" alt=""></a>
+            <div class="caption">
+              <a href="cluster-intro/"><h5>1. 创建一个 Kubernetes 集群</h5></a>
+            </div>
+          </div>
+        </div>
+        <div class="col-md-4">
+          <div class="thumbnail">
+            <a href="/docs/tutorials/kubernetes-basics/deploy-intro/"><img src="./public/images/module_02.svg?v=1469803628347" alt=""></a>
+            <div class="caption">
+              <a href="deploy-intro/"><h5>2. 部署应用程序</h5></a>
+            </div>
+          </div>
+        </div>
+        <div class="col-md-4">
+          <div class="thumbnail">
+            <a href="/docs/tutorials/kubernetes-basics/explore-intro/"><img src="./public/images/module_03.svg?v=1469803628347" alt=""></a>
+            <div class="caption">
+              <a href="explore-intro/"><h5>3. 应用程序探索</h5></a>
+            </div>
+          </div>
+        </div>
+        <div class="col-md-4">
+          <div class="thumbnail">
+            <a href="/docs/tutorials/kubernetes-basics/expose-intro/"><img src="./public/images/module_04.svg?v=1469803628347" alt=""></a>
+            <div class="caption">
+              <a href="expose-intro/"><h5>4. 应用外部可见</h5></a>
+            </div>
+          </div>
+        </div>
+        <div class="col-md-4">
+          <div class="thumbnail">
+            <a href="/docs/tutorials/kubernetes-basics/scale-intro/"><img src="./public/images/module_05.svg?v=1469803628347" alt=""></a>
+            <div class="caption">
+              <a href="scale-intro/"><h5>5. 应用可伸缩</h5></a>
+            </div>
+          </div>
+        </div>
+        <div class="col-md-4">
+          <div class="thumbnail">
+            <a href="/docs/tutorials/kubernetes-basics/update-intro/"><img src="./public/images/module_06.svg?v=1469803628347" alt=""></a>
+            <div class="caption">
+              <a href="update-intro/"><h5>6. 应用更新</h5></a>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <div class="row">
+      <div class="col-md-12">
+        <a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/cluster-intro/" role="button">开始教程<span class="btn__next">›</span></a>
+      </div>
+    </div>
+
+  </main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,38 @@
+---
+title: 交互式教程 - 扩展您的应用程序
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+<script src="https://katacoda.com/embed.js"></script>
+
+<div class="layout" id="top">
+
+    <main class="content katacoda-content">
+
+        <div class="katacoda">
+            <div class="katacoda__alert">
+                To interact with the Terminal, please use the desktop/tablet version
+            </div>
+            <div class="katacoda__box" id="inline-terminal-1"  data-katacoda-id="kubernetes-bootcamp/5" data-katacoda-color="326de6" data-katacoda-secondary="273d6d" data-katacoda-hideintro="false" data-katacoda-font="Roboto" data-katacoda-fontheader="Roboto Slab" data-katacoda-prompt="Kubernetes Bootcamp Terminal" style="height: 600px;">
+            </div>
+        </div>
+        <div class="row">
+            <div class="col-md-12">
+                <a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/update-intro/" role="button">Continue to Module 6<span class="btn__next">›</span></a>
+            </div>
+        </div>
+
+    </main>
+
+<a class="scrolltop" href="#top"></a>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,120 @@
+---
+title: 运行应用程序的多个实例
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+
+<div class="layout" id="top">
+
+	<main class="content">
+
+		<div class="row">
+
+     <div class="col-md-8">
+      	<h3>目标</h3>
+				<ul>
+					<li>使用 kubectl 缩放应用程序</li>
+				</ul>
+			</div>
+
+			<div class="col-md-8">
+       <h3>缩放应用程序</h3>
+
+			<p>在之前的模块中，我们创建了一个 <a href="http://kubernetes.io/docs/user-guide/deployments/"> Deployment</a>，然后通过 <a href="http://kubernetes.io/docs/user-guide/services/">Service</a>让应用程序外部可见。Deployment 仅为我们的应用程序创建了一个 Pod。 当流量增加时，我们将需要扩展应用程序以跟上用户需求。</p>
+
+			<p><b>Scaling</b> 是通过更改 Deployment 中的副本数量实现的。</p>
+
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_lined">
+					<h3>摘要:</h3>
+					<ul>
+						<li>Deployment 的缩放</li>
+					</ul>
+				</div>
+				<div class="content__box content__box_fill">
+					<p><i> 您可以使用 kubectl run 命令的 --replicas 参数，在创建 Deployment 时指定多个实例。 </i></p>
+				</div>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<h2 style="color: #3771e3;">Scaling 概述</h2>
+			</div>
+		</div>
+
+		<div class="row">
+			<div class="col-md-1"></div>
+			<div class="col-md-8">
+				<div id="myCarousel" class="carousel" data-ride="carousel" data-interval="3000">
+					<ol class="carousel-indicators">
+					    <li data-target="#myCarousel" data-slide-to="0" class="active"></li>
+					    <li data-target="#myCarousel" data-slide-to="1"></li>
+					</ol>
+					  <div class="carousel-inner" role="listbox">
+					    <div class="item active">
+					      <img src="/docs/tutorials/kubernetes-basics/public/images/module_05_scaling1.svg">
+					    </div>
+
+					    <div class="item">
+					      <img src="/docs/tutorials/kubernetes-basics/public/images/module_05_scaling2.svg">
+					    </div>
+					  </div>
+
+					  <a class="left carousel-control" href="#myCarousel" role="button" data-slide="prev">
+						<span class="sr-only ">Previous</span>
+					  </a>
+					  <a class="right carousel-control" href="#myCarousel" role="button" data-slide="next">
+						<span class="sr-only">Next</span>
+					  </a>
+
+					</div>
+			</div>
+		</div>
+
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+
+				<p>扩展 Deployment 将确保新创建的 Pods 会调度到可用资源的 Node 节点上，收缩会保证 Pods 数量减少至新的所需状态。  Kubernetes 还支持 Pods 的 <a href="http://kubernetes.io/docs/user-guide/horizontal-pod-autoscaling/"> 自动缩放版 </a> ，但不在本教程范围之内。收缩到零也是可以的，此时它将终止指定 Deployment 的所有 Pod。 </p>
+
+				<p>运行应用程序的多个实例需要一种将流量分发给所有实例的方法。服务有内置的负载均衡器，可将网络流量分配给 Deployment 暴露的所有 Pods。服务通过使用 endpoints 持续监控运行的 Pods，以确保流量仅发送到可用的 Pods。</p>
+
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_fill">
+					<p><i>通过更改 Deployment 中的副本数可以实现伸缩应用程序。</i></p>
+				</div>
+			</div>
+		</div>
+
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p> 一旦您有应用程序的多个实例，您将能够滚动更新而不会停止服务。我们将在下一个模块中介绍。现在，我们去在线终端扩展我们的应用程序。</p>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-12">
+				<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/scale-interactive/" role="button">启动交互式教程 <span class="btn__next">›</span></a>
+			</div>
+		</div>
+
+	</main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,31 @@
+---
+title: 交互式教程 - 更新您的应用程序
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+<script src="https://katacoda.com/embed.js"></script>
+
+<div class="layout" id="top">
+
+    <main class="content katacoda-content">
+
+        <div class="katacoda">
+            <div class="katacoda__alert">
+                To interact with the Terminal, please use the desktop/tablet version
+            </div>
+            <div class="katacoda__box" id="inline-terminal-1"  data-katacoda-id="kubernetes-bootcamp/6" data-katacoda-color="326de6" data-katacoda-secondary="273d6d" data-katacoda-hideintro="false" data-katacoda-font="Roboto" data-katacoda-fontheader="Roboto Slab" data-katacoda-prompt="Kubernetes Bootcamp Terminal" style="height: 600px;">
+            </div>
+        </div>
+
+    </main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,135 @@
+---
+title: 执行滚动更新
+---
+
+<!DOCTYPE html>
+
+<html lang="en">
+
+<body>
+
+<link href="/docs/tutorials/kubernetes-basics/public/css/styles.css" rel="stylesheet">
+
+<div class="layout" id="top">
+
+	<main class="content">
+
+		<div class="row">
+
+     <div class="col-md-8">
+      	<h3>目标</h3>
+				<ul>
+					<li>使用 kubectl 执行滚动更新</li>
+				</ul>
+			</div>
+
+			<div class="col-md-8">
+			<h3>更新应用程序</h3>
+
+			<p>用户期望应用程序始终可用，并且开发人员有望每天部署新版本。这就是 Kubernetes 的滚动更新。 <b>Rolling updates</b> 允许通过使用新的 Pods 实例逐个更新来实现零停机的更新部署。新的 Pods 会被调度到可用资源的 Node 节点上。</p>
+
+			<p>在上一个模块中，我们将应用程序扩展为运行多个实例。这是执行更新但不影响应用可用性的要求。默认情况下，更新期间最大数量的 Pods 可能不可用，此时创建和更新 Pod 的最大数量是一。 这两个选项可以配置为数字或百分比(Pods)。
+			在 Kubernetes 中，更新已版本化，任何部署更新都可以恢复到以前的 (稳定) 版本。</p>
+
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_lined">
+					<h3>摘要:</h3>
+					<ul>
+						<li>更新应用程序</li>
+					</ul>
+				</div>
+				<div class="content__box content__box_fill">
+					<p><i>滚动更新允许通过使用新的 Pods 实例逐个更新来实现零停机的部署更新。 </i></p>
+				</div>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<h2 style="color: #3771e3;">滚动更新概述</h2>
+			</div>
+		</div>
+		<div class="row">
+			<div class="col-md-1"></div>
+			<div class="col-md-8">
+				<div id="myCarousel" class="carousel" data-ride="carousel" data-interval="3000">
+					<ol class="carousel-indicators">
+					    <li data-target="#myCarousel" data-slide-to="0" class="active"></li>
+					    <li data-target="#myCarousel" data-slide-to="1"></li>
+					    <li data-target="#myCarousel" data-slide-to="2"></li>
+					    <li data-target="#myCarousel" data-slide-to="3"></li>
+					</ol>
+					  <div class="carousel-inner" role="listbox">
+					    <div class="item active">
+					      <img src="/docs/tutorials/kubernetes-basics/public/images/module_06_rollingupdates1.svg" >
+					    </div>
+
+					    <div class="item">
+					      <img src="/docs/tutorials/kubernetes-basics/public/images/module_06_rollingupdates2.svg">
+					    </div>
+
+					    <div class="item">
+					      <img src="/docs/tutorials/kubernetes-basics/public/images/module_06_rollingupdates3.svg">
+					    </div>
+
+					    <div class="item">
+					      <img src="/docs/tutorials/kubernetes-basics/public/images/module_06_rollingupdates4.svg">
+					    </div>
+					  </div>
+
+					  <a class="left carousel-control" href="#myCarousel" role="button" data-slide="prev">
+						<span class="sr-only ">Previous</span>
+					  </a>
+					  <a class="right carousel-control" href="#myCarousel" role="button" data-slide="next">
+						<span class="sr-only">Next</span>
+					  </a>
+
+					</div>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+
+				<p>与应用程序缩放类似，如果 Deployment 外部可见，则 Service 将在更新期间将流量负载均衡到可用的 Pod。可用的 Pod 指的是应用程序用户可用的实例。</p>
+
+				<p>滚动更新允许以下操作:</p>
+				<ul>
+					<li>将应用程序从一个环境升级到另一个环境 (通过容器镜像更新)</li>
+					<li>回滚到以前的版本</li>
+					<li>持续集成和持续交付，实现应用程序零故障</li>
+
+				</ul>
+
+			</div>
+			<div class="col-md-4">
+				<div class="content__box content__box_fill">
+					<p><i>如果部署外部可见，则服务将在更新期间将流量负载均衡到可用的 Pod。 </i></p>
+				</div>
+			</div>
+		</div>
+
+		<br>
+
+		<div class="row">
+			<div class="col-md-8">
+				<p> 在下面的交互式教程中，我们将把应用程序更新到一个新版本，并执行回滚。</p>
+			</div>
+		</div>
+		<br>
+
+		<div class="row">
+			<div class="col-md-12">
+				<a class="btn btn-lg btn-success" href="/docs/tutorials/kubernetes-basics/update-interactive/" role="button">启动交互式教程<span class="btn__next">›</span></a>
+			</div>
+		</div>
+
+	</main>
+
+</div>
+
+</body>
+</html>
@@ -0,0 +1,9 @@
+---
+assignees:
+- k8s-merge-robot
+title: 认识 Kubernetes?
+---
+
+{% include user-guide-content-moved.md %}
+
+[认识 Kubernetes?](/docs/concepts/overview/what-is-kubernetes/)
@@ -3,12 +3,12 @@ assignees:
 - bgrant0607
 - erictune
 - lavalamp
-title: Controlling Accessing to the Kubernetes API
+title: Controlling Access to the Kubernetes API
 ---

 Users [access the API](/docs/user-guide/accessing-the-cluster) using `kubectl`,
 client libraries, or by making REST requests.  Both human users and
-[Kubernetes service accounts](/docs/user-guide/service-accounts/) can be
+[Kubernetes service accounts](/docs/tasks/configure-pod-container/configure-service-account/) can be
 authorized for API access.
 When a request reaches the API, it goes through several stages, illustrated in the
 following diagram:
@@ -57,43 +57,48 @@ users in its object store.

 ## Authorization

-Once the request is authenticated as coming from a specific user,
-it moves to a generic authorization step.  This is shown as step **2** in the
-diagram.
+After the request is authenticated as coming from a specific user, the request must be authorized. This is shown as step **2** in the diagram. 

-The input to the Authorization step are attributes of the REST request, including:
-  - the username determined by the Authentication step.
-  - a `verb` associated with the API request.  Most object support these common operations: `list, watch, create, update, patch, delete`.  Some objects have "special verbs"; for example pods and services can be `proxy`-ed.
-  - any subresource associated with the API request (e.g. `status`).
-  - the Group, Version, and Kind of the API resource (e.g. `v1 pod`, or `batch/v1 job`) being
-    operated on.
-  - the name and namespace of the object.
+A request must include the username of the requester, the requested action, and the object affected by the action. The request is authorized if an existing policy declares that the user has permissions to complete the requested action. 

-There are multiple supported Authorization Modules.  The cluster creator configures the API
-server with which Authorization Modules should be used.  When multiple Authorization Modules
-are configured, each is checked in sequence, and if any Module authorizes the request,
-then the request can proceed.  If all deny the request, then the request is denied (HTTP status
-code 403).
+For example, if Bob has the policy below, then he can read pods only in the namespace `projectCaribou`:

-The [Authorization Modules](/docs/admin/authorization) page describes what authorization modules
-are available and how to configure them.
+```json
+{
+    "apiVersion": "abac.authorization.kubernetes.io/v1beta1",
+    "kind": "Policy",
+    "spec": {
+        "user": "bob",
+        "namespace": "projectCaribou",
+        "resource": "pods",
+        "readonly": true
+    }
+}
+```
+If Bob makes the following request, the request is authorized because he is allowed to read objects in the `projectCaribou` namespace:

-For version 1.2, clusters created by `kube-up.sh` are configured so that no authorization is
-required for any request.
+```json
+{
+  "apiVersion": "authorization.k8s.io/v1beta1",
+  "kind": "SubjectAccessReview",
+  "spec": {
+    "resourceAttributes": {
+      "namespace": "projectCaribou",
+      "verb": "get",
+      "group": "unicorn.example.org",
+      "resource": "pods"
+    }
+  }
+}
+```
+If Bob makes a request to write (`create` or `update`) to the objects in the `projectCaribou` namespace, his authorization is denied. If Bob makes a request to read (`get`) objects in a different namespace such as `projectFish`, then his authorization is denied. 

-As of version 1.3, clusters created by `kube-up.sh` are configured so that the ABAC authorization
-modules are enabled.  However, its input file is initially set to allow all users to do all
-operations.  The cluster administrator needs to edit that file, or configure a different authorizer
-to restrict what users can do.
+Kubernetes authorization requires that you use common REST attributes to interact with existing organization-wide or cloud-provider-wide access control systems. It is important to use REST formatting because these control systems might interact with other APIs besides the Kubernetes API.

+Kubernetes supports multiple authorization modules, such as ABAC mode, RBAC Mode, and Webhook mode. When an administrator creates a cluster, they configured the authorization modules that should be used in the API server. If more than one authorization modules are configured, Kubernetes checks each module, and if any module authorizes the request, then the request can proceed. If all of the modules deny the request, then the request is denied (HTTP status code 403).

-The Authorization step is designed to operate on attributes that are likely to be common to most
-REST requests, such as object name, kind, etc.  This is intended to facilitate interation with
-existing organization-wide or cloud-provider-wide access control systems (which may handle
-other APIs besides the Kubernetes API).
+To learn more about Kubernetes authorization, including details about creating policies using the supported authorization modules, see [Authorization Overview](/docs/admin/authorization). 

-Access controls and policies that depend on specific fields of specific Kinds of objects
-are handled by Admission Controllers.

 ## Admission Control

@@ -87,7 +87,7 @@ The ImagePolicyWebhook plug-in allows a backend webhook to make admission decisi
 ```

 #### Configuration File Format
-ImagePolicyWebhook uses the admission config file `--admission-controller-config-file` to set configuration options for the behavior of the backend. This file may be json or yaml and has the following format:
+ImagePolicyWebhook uses the admission config file `--admission-control-config-file` to set configuration options for the behavior of the backend. This file may be json or yaml and has the following format:

 ```javascript
 {
@@ -197,7 +197,7 @@ We strongly recommend using this plug-in if you intend to make use of Kubernetes

 ### SecurityContextDeny

-This plug-in will deny any pod with a [SecurityContext](/docs/user-guide/security-context) that defines options that were not available on the `Container`.
+This plug-in will deny any pod that attempts to set certain escalating [SecurityContext](/docs/user-guide/security-context) fields. This should be enabled if a cluster doesn't utilize [pod security policies](/docs/user-guide/pod-security-policy) to restrict the set of values a security context can take.

 ### ResourceQuota

@@ -205,7 +205,7 @@ This plug-in will observe the incoming request and ensure that it does not viola
 enumerated in the `ResourceQuota` object in a `Namespace`.  If you are using `ResourceQuota`
 objects in your Kubernetes deployment, you MUST use this plug-in to enforce quota constraints.

-See the [resourceQuota design doc](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/design/admission_control_resource_quota.md) and the [example of Resource Quota](/docs/admin/resourcequota/) for more details.
+See the [resourceQuota design doc](https://git.k8s.io/community/contributors/design-proposals/admission_control_resource_quota.md) and the [example of Resource Quota](/docs/concepts/policy/resource-quotas/) for more details.

 It is strongly encouraged that this plug-in is configured last in the sequence of admission control plug-ins.  This is
 so that quota is not prematurely incremented only for the request to be rejected later in admission control.
@@ -218,7 +218,7 @@ your Kubernetes deployment, you MUST use this plug-in to enforce those constrain
 be used to apply default resource requests to Pods that don't specify any; currently, the default LimitRanger
 applies a 0.1 CPU requirement to all Pods in the `default` namespace.

-See the [limitRange design doc](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/design/admission_control_limit_range.md) and the [example of Limit Range](/docs/admin/limitrange/) for more details.
+See the [limitRange design doc](https://git.k8s.io/community/contributors/design-proposals/admission_control_limit_range.md) and the [example of Limit Range](/docs/tasks/configure-pod-container/limit-range/) for more details.

 ### InitialResources (experimental)

@@ -227,7 +227,7 @@ then the plug-in auto-populates a compute resource request based on historical u
 If there is not enough data to make a decision the Request is left unchanged.
 When the plug-in sets a compute resource request, it annotates the pod with information on what compute resources it auto-populated.

-See the [InitialResouces proposal](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/proposals/initial-resources.md) for more details.
+See the [InitialResouces proposal](https://git.k8s.io/community/contributors/design-proposals/initial-resources.md) for more details.

 ### NamespaceLifecycle

@@ -257,9 +257,55 @@ storage classes and how to mark a storage class as default.
 This plug-in sets the default forgiveness toleration for pods, which have no forgiveness tolerations, to tolerate
 the taints `notready:NoExecute` and `unreachable:NoExecute` for 5 minutes.

+### PodNodeSelector
+
+This plug-in defaults and limits what node selectors may be used within a namespace by reading a namespace annotation and a global configuration.
+
+#### Configuration File Format
+PodNodeSelector uses the admission config file `--admission-control-config-file` to set configuration options for the behavior of the backend.
+
+Note that the configuration file format will move to a versioned file in a future release.
+
+This file may be json or yaml and has the following format:
+
+```yaml
+podNodeSelectorPluginConfig:
+ clusterDefaultNodeSelector: <node-selectors-labels>
+ namespace1: <node-selectors-labels>
+ namespace2: <node-selectors-labels>
+```
+
+#### Configuration Annotation Format
+PodNodeSelector uses the annotation key `scheduler.alpha.kubernetes.io/node-selector` to assign node selectors to namespaces.
+
+```yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    scheduler.alpha.kubernetes.io/node-selector: <node-selectors-labels>
+  name: namespace3
+```
+
+### PodSecurityPolicy
+
+This plug-in acts on creation and modification of the pod and determines if it should be admitted
+based on the requested security context and the available Pod Security Policies.
+
+For Kubernetes < 1.6.0, the API Server must enable the extensions/v1beta1/podsecuritypolicy API
+extensions group (`--runtime-config=extensions/v1beta1/podsecuritypolicy=true`).
+
+See also [Pod Security Policy documentation](/docs/concepts/policy/pod-security-policy/)
+for more information.
+
 ## Is there a recommended set of plug-ins to use?

 Yes.
+For Kubernetes >= 1.6.0, we strongly recommend running the following set of admission control plug-ins (order matters):
+
+```shell
+--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds
+```

 For Kubernetes >= 1.4.0, we strongly recommend running the following set of admission control plug-ins (order matters):

@@ -1,9 +0,0 @@
---
-assignees:
- stclair
-title: AppArmor
---
-
-{% include user-guide-content-moved.md %}
-
-[AppArmor](/docs/tutorials/clusters/apparmor/)
@@ -1,10 +0,0 @@
---
-assignees:
- soltysh
- sttts
-title: Audit in Kubernetes
---
-
-{% include user-guide-content-moved.md %}
-
-[Auditing](/docs/concepts/cluster-administration/audit/)
@@ -54,7 +54,7 @@ You can enable multiple authentication methods at once. You should usually use a
 - service account tokens for service accounts
 - at least one other method for user authentication.

-When multiple are enabled, the first authenticator module
+When multiple authenticator modules are enabled, the first module
 to successfully authenticate the request short-circuits evaluation.
 The API server does not guarantee the order authenticators run in.

@@ -580,6 +580,111 @@ Starting in 1.6, the ABAC and RBAC authorizers require explicit authorization of
 `system:anonymous` user or the `system:unauthenticated` group, so legacy policy rules
 that grant access to the `*` user or `*` group do not include anonymous users.

+## User impersonation
+
+A user can act as another user through impersonation headers. These let requests
+manually override the user info a request authenticates as. For example, an admin
+could use this feature to debug an authorization policy by temporarily
+impersonating another user and seeing if a request was denied.
+
+Impersonation requests first authenticate as the requesting user, then switch
+to the impersonated user info.
+
+* A user makes an API call with their credentials _and_ impersonation headers.
+* API server authenticates the user.
+* API server ensures the authenticated users has impersonation privileges.
+* Request user info is replaced with impersonation values.
+* Request is evaluated, authorization acts on impersonated user info.
+
+The following HTTP headers can be used to performing an impersonation request:
+
+* `Impersonate-User`: The username to act as.
+* `Impersonate-Group`: A group name to act as. Can be provided multiple times to set multiple groups. Optional. Requires "Impersonate-User"
+* `Impersonate-Extra-( extra name )`: A dynamic header used to associate extra fields with the user. Optional. Requires "Impersonate-User"
+
+An example set of headers:
+
+```http
+Impersonate-User: jane.doe@example.com
+Impersonate-Group: developers
+Impersonate-Group: admins
+Impersonate-Extra-dn: cn=jane,ou=engineers,dc=example,dc=com
+Impersonate-Extra-scopes: view
+Impersonate-Extra-scopes: development
+```
+
+When using `kubectl` set the `--as` flag to configure the `Impersonate-User`
+header.
+
+```shell
+$ kubectl drain mynode
+Error from server (Forbidden): User "clark" cannot get nodes at the cluster scope. (get nodes mynode)
+
+$ kubectl drain mynode --as=superman
+node "mynode" cordoned
+node "mynode" drained
+```
+
+To impersonate a user, group, or set extra fields, the impersonating user must
+have the ability to perform the "impersonate" verb on the kind of attribute
+being impersonated ("user", "group", etc.). For clusters that enable the RBAC
+authorization plugin, the following ClusterRole encompasses the rules needed to
+set user and group impersonation headers:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: impersonator
+rules:
+- apiGroups: [""]
+  resources: ["users", "groups", "serviceaccounts"]
+  verbs: ["impersonate"]
+```
+
+Extra fields are evaluated as sub-resources of the resource "userextras". To
+allow a user to use impersonation headers for the extra field "scopes," a user
+should be granted the following role:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: scopes-impersonator
+# Can set "Impersonate-Extra-scopes" header.
+- apiGroups: ["authentication.k8s.io"]
+  resources: ["userextras/scopes"]
+  verbs: ["impersonate"]
+```
+
+The values of impersonation headers can also be restricted by limiting the set
+of `resourceNames` a resource can take.
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: limited-impersonator
+rules:
+# Can impersonate the user "jane.doe@example.com"
+- apiGroups: [""]
+  resources: ["users"]
+  verbs: ["impersonate"]
+  resourceNames: ["jane.doe@example.com"]
+
+# Can impersonate the groups "developers" and "admins"
+- apiGroups: [""]
+  resources: ["groups"]
+- verbs: ["impersonate"]
+  resourceNames: ["developers","admins"]
+
+# Can impersonate the extras field "scopes" with the values "view" and "development"
+- apiGroups: ["authentication.k8s.io"]
+  resources: ["userextras/scopes"]
+  verbs: ["impersonate"]
+  resourceNames: ["view", "development"]
+```
+
 ## Plugin Development

 We plan for the Kubernetes API server to issue tokens after the user has been
@@ -0,0 +1,155 @@
+---
+assignees:
+- erictune
+- lavalamp
+- deads2k
+- liggitt
+title: ABAC Mode
+---
+
+{% capture overview %}
+Attribute-based access control (ABAC) defines an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together.
+{% endcapture %}
+
+{% capture body %}
+## Policy File Format
+
+For mode `ABAC`, also specify `--authorization-policy-file=SOME_FILENAME`.
+
+The file format is [one JSON object per line](http://jsonlines.org/).  There
+should be no enclosing list or map, just one map per line.
+
+Each line is a "policy object".  A policy object is a map with the following
+properties:
+
+  - Versioning properties:
+    - `apiVersion`, type string; valid values are "abac.authorization.kubernetes.io/v1beta1". Allows versioning and conversion of the policy format.
+    - `kind`, type string: valid values are "Policy". Allows versioning and conversion of the policy format.
+  - `spec` property set to a map with the following properties:
+    - Subject-matching properties:
+      - `user`, type string; the user-string from `--token-auth-file`. If you specify `user`, it must match the username of the authenticated user.
+      - `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `system:authenticated` matches all authenticated requests. `system:unauthenticated` matches all unauthenticated requests.
+    - Resource-matching properties:
+      - `apiGroup`, type string; an API group.
+        - Ex: `extensions`
+        - Wildcard: `*` matches all API groups.
+      - `namespace`, type string; a namespace.
+        - Ex: `kube-system`
+        - Wildcard: `*` matches all resource requests.
+      - `resource`, type string; a resource type
+        - Ex: `pods`
+        - Wildcard: `*` matches all resource requests.
+    - Non-resource-matching properties:
+      - `nonResourcePath`, type string; non-resource request paths.
+        - Ex: `/version` or `/apis`
+        - Wildcard: 
+          - `*` matches all non-resource requests.
+          - `/foo/*` matches all subpaths of `/foo/`.
+    - `readonly`, type boolean, when true, means that the policy only applies to get, list, and watch operations.
+
+**NOTES:** An unset property is the same as a property set to the zero value for its type
+(e.g. empty string, 0, false). However, unset should be preferred for
+readability.
+
+In the future, policies may be expressed in a JSON format, and managed via a
+REST interface.
+
+## Authorization Algorithm
+
+A request has attributes which correspond to the properties of a policy object.
+
+When a request is received, the attributes are determined.  Unknown attributes
+are set to the zero value of its type (e.g. empty string, 0, false).
+
+A property set to `"*"` will match any value of the corresponding attribute.
+
+The tuple of attributes is checked for a match against every policy in the
+policy file. If at least one line matches the request attributes, then the
+request is authorized (but may fail later validation).
+
+To permit any authenticated user to do something, write a policy with the
+group property set to `"system:authenticated"`.
+
+To permit any unauthenticated user to do something, write a policy with the
+group property set to `"system:unauthenticated"`.
+
+To permit a user to do anything, write a policy with the apiGroup, namespace,
+resource, and nonResourcePath properties set to `"*"`.
+
+## Kubectl
+
+Kubectl uses the `/api` and `/apis` endpoints of api-server to negotiate
+client/server versions. To validate objects sent to the API by create/update
+operations, kubectl queries certain swagger resources. For API version `v1`
+those would be `/swaggerapi/api/v1` & `/swaggerapi/experimental/v1`.
+
+When using ABAC authorization, those special resources have to be explicitly
+exposed via the `nonResourcePath` property in a policy (see [examples](#examples) below):
+
+* `/api`, `/api/*`, `/apis`, and `/apis/*` for API version negotiation.
+* `/version` for retrieving the server version via `kubectl version`.
+* `/swaggerapi/*` for create/update operations.
+
+To inspect the HTTP calls involved in a specific kubectl operation you can turn
+up the verbosity:
+
+    kubectl --v=8 version
+
+## Examples
+
+ 1. Alice can do anything to all resources:
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "alice", "namespace": "*", "resource": "*", "apiGroup": "*"}}
+    ```
+ 2. Kubelet can read any pods:
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "pods", "readonly": true}}
+    ```
+ 3. Kubelet can read and write events:
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "events"}}
+    ```
+ 4. Bob can just read pods in namespace "projectCaribou":
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "bob", "namespace": "projectCaribou", "resource": "pods", "readonly": true}}
+    ```
+ 5. Anyone can make read-only requests to all non-resource paths:
+
+    ```json
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:authenticated", "readonly": true, "nonResourcePath": "*"}}
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:unauthenticated", "readonly": true, "nonResourcePath": "*"}}
+    ```
+
+[Complete file example](http://releases.k8s.io/{{page.githubbranch}}/pkg/auth/authorizer/abac/example_policy_file.jsonl)
+
+## A quick note on service accounts
+
+A service account automatically generates a user. The user's name is generated
+according to the naming convention:
+
+```shell
+system:serviceaccount:<namespace>:<serviceaccountname>
+```
+Creating a new namespace also causes a new service account to be created, of
+this form:
+
+```shell
+system:serviceaccount:<namespace>:default
+```
+
+For example, if you wanted to grant the default service account in the
+kube-system full privilege to the API, you would add this line to your policy
+file:
+
+```json
+{"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"system:serviceaccount:kube-system:default","namespace":"*","resource":"*","apiGroup":"*"}}
+```
+
+The apiserver will need to be restarted to pickup the new policy lines.
+
+{% endcapture %}
+{% include templates/concept.md %}
@@ -7,55 +7,40 @@ assignees:
 title: Overview
 ---

-In Kubernetes, authorization happens as a separate step from authentication.
-See the [Accessing Control Overview](/docs/admin/accessing-the-api/) for an
-overview of how authentication and authorization are applied to requests.
+{% capture overview %}
+Learn more about Kubernetes authorization, including details about creating policies using the supported authorization modules.
+{% endcapture %}

-Authorization applies to all HTTP accesses on the main (secure) apiserver port.
+{% capture body %}
+In Kubernetes, you must be authenticated (logged in) before your request can be authorized (granted permission to access). For information about authentication, see [Accessing Control Overview](/docs/admin/accessing-the-api/).

-The authorization check for any request compares attributes of the context of
-the request, (such as user, resource, and namespace) with access
-policies.  An API call must be allowed by some policy in order to proceed.
+Kubernetes expects attributes that are common to REST API requests. This means that Kubernetes authorization works with existing organization-wide or cloud-provider-wide access control systems which may handle other APIs besides the Kubernetes API.

-The following implementations are available, and are selected by flag:
+## Determine Whether a Request is Allowed or Denied
+Kubernetes authorizes API requests using the API server. It evaluates all of the request attributes against all policies and allows or denies the request. All parts of an API request must be allowed by some policy in order to proceed. This means that permissions are denied by default.

-  - `--authorization-mode=AlwaysDeny` blocks all requests (used in tests).
-  - `--authorization-mode=AlwaysAllow` allows all requests; use if you don't
-need authorization.
-  - `--authorization-mode=ABAC` allows for a simple local-file-based user-configured
-authorization policy.  ABAC stands for Attribute-Based Access Control.
-  - `--authorization-mode=RBAC` allows for authorization to be driven by policy
-stored in the Kubernetes API. RBAC stands for Role-Based Access Control.
-  - `--authorization-mode=Webhook` allows for authorization to be driven by a
-remote service using REST.
+(Although Kubernetes uses the API server, access controls and policies that depend on specific fields of specific kinds of objects are handled by Admission Controllers.)

-If multiple modes are provided the set is unioned, and only a single authorizer is required to admit the action.  This means the flag:
+When multiple authorization modules are configured, each is checked in sequence, and if any module authorizes the request, then the request can proceed. If all modules deny the request, then the request is denied (HTTP status code 403).

-```
--authorization-mode=AlwaysDeny,AlwaysAllow
-```
+## Review Your Request Attributes
+Kubernetes reviews only the following API request attributes:

-will always allow.
+ * **user** - The `user` string provided during authentication
+ * **group** - The list of group names to which the authenticated user belongs
+ * **"extra"** - A map of arbitrary string keys to string values, provided by the authentication layer
+ * **API** - Indicates whether the request is for an API resource
+ * **Request path** - Path to miscellaneous non-resource endpoints like `/api` or `/healthz` (see [kubectl](#kubectl)).
+ * **API request verb** - API verbs `get`, `list`, `create`, `update`, `patch`, `watch`, `proxy`, `redirect`, `delete`, and `deletecollection` are used for resource requests. To determine the request verb for a resource API endpoint, see **Determine the request verb** below.
+ * **HTTP request verb** - HTTP verbs `get`, `post`, `put`, and `delete` are used for non-resource requests
+ * **Resource** - The ID or name of the resource that is being accessed (for resource requests only)
+--* For resource requests using `get`, `update`, `patch`, and `delete` verbs, you must provide the resource name.
+ * **Subresource** - The subresource that is being accessed (for resource requests only)
+ * **Namespace** - The namespace of the object that is being accessed (for namespaced resource requests only)
+ * **API group** - The API group being accessed (for resource requests only). An empty string designates the [core API group](/docs/api/).

-## Request Attributes
-
-A request has the following attributes that can be considered for authorization:
-
-  - user (the user-string which a user was authenticated as).
-  - group (the list of group names the authenticated user is a member of).
-  - "extra" (a map of arbitrary string keys to string values, provided by the authentication layer)
-  - whether the request is for an API resource.
-  - the request path.
-    - allows authorizing access to miscellaneous non-resource endpoints like `/api` or `/healthz` (see [kubectl](#kubectl)).
-  - the request verb.
-    - API verbs `get`, `list`, `create`, `update`, `patch`, `watch`, `proxy`, `redirect`, `delete`, and `deletecollection` are used for resource requests
-    - HTTP verbs `get`, `post`, `put`, and `delete` are used for non-resource requests
-  - what resource is being accessed (for resource requests only)
-  - what subresource is being accessed (for resource requests only)
-  - the namespace of the object being accessed (for namespaced resource requests only)
-  - the API group being accessed (for resource requests only); an empty string designates the [core API group](/docs/api/)
-
-The request verb for a resource API endpoint can be determined by the HTTP verb used and whether or not the request acts on an individual resource or a collection of resources:
+## Determine the Request Verb
+To determine the request verb for a resource API endpoint, review the HTTP verb used and whether or not the request acts on an individual resource or a collection of resources:

 HTTP verb | request verb
 ----------|---------------
@@ -65,304 +50,24 @@ PUT       | update
 PATCH     | patch
 DELETE    | delete (for individual resources), deletecollection (for collections)

-Some components perform authorization checks for additional permissions using specialized verbs. For example:
+Kubernetes sometimes checks authorization for additional permissions using specialized verbs. For example:

-* [PodSecurityPolicy](/docs/user-guide/pod-security-policy/) checks for authorization of the `use` verb on `podsecuritypolicies` resources in the `extensions` API group.
+* [PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/) checks for authorization of the `use` verb on `podsecuritypolicies` resources in the `extensions` API group.
 * [RBAC](/docs/admin/authorization/rbac/#privilege-escalation-prevention-and-bootstrapping) checks for authorization 
 of the `bind` verb on `roles` and `clusterroles` resources in the `rbac.authorization.k8s.io` API group.
-* [Authentication](/docs/admin/authentication/) layer checks for authorization of the `impersonate` verb on `users`, `groups`, and `userextras` in the `authentication.k8s.io` API group, and the `serviceaccounts` in the core API group.
-
-## ABAC Mode
-
-### Policy File Format
-
-For mode `ABAC`, also specify `--authorization-policy-file=SOME_FILENAME`.
-
-The file format is [one JSON object per line](http://jsonlines.org/).  There
-should be no enclosing list or map, just one map per line.
-
-Each line is a "policy object".  A policy object is a map with the following
-properties:
-
-  - Versioning properties:
-    - `apiVersion`, type string; valid values are "abac.authorization.kubernetes.io/v1beta1". Allows versioning and conversion of the policy format.
-    - `kind`, type string: valid values are "Policy". Allows versioning and conversion of the policy format.
-  - `spec` property set to a map with the following properties:
-    - Subject-matching properties:
-      - `user`, type string; the user-string from `--token-auth-file`. If you specify `user`, it must match the username of the authenticated user.
-      - `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `system:authenticated` matches all authenticated requests. `system:unauthenticated` matches all unauthenticated requests.
-    - Resource-matching properties:
-      - `apiGroup`, type string; an API group.
-        - Ex: `extensions`
-        - Wildcard: `*` matches all API groups.
-      - `namespace`, type string; a namespace.
-        - Ex: `kube-system`
-        - Wildcard: `*` matches all resource requests.
-      - `resource`, type string; a resource type
-        - Ex: `pods`
-        - Wildcard: `*` matches all resource requests.
-    - Non-resource-matching properties:
-      - `nonResourcePath`, type string; non-resource request paths.
-        - Ex: `/version` or `/apis`
-        - Wildcard: 
-          - `*` matches all non-resource requests.
-          - `/foo/*` matches `/foo/` and all of its subpaths.
-    - `readonly`, type boolean, when true, means that the policy only applies to get, list, and watch operations.
-
-**NOTES:** An unset property is the same as a property set to the zero value for its type
-(e.g. empty string, 0, false). However, unset should be preferred for
-readability.
-
-In the future, policies may be expressed in a JSON format, and managed via a
-REST interface.
-
-### Authorization Algorithm
-
-A request has attributes which correspond to the properties of a policy object.
-
-When a request is received, the attributes are determined.  Unknown attributes
-are set to the zero value of its type (e.g. empty string, 0, false).
-
-A property set to `"*"` will match any value of the corresponding attribute.
-
-The tuple of attributes is checked for a match against every policy in the
-policy file. If at least one line matches the request attributes, then the
-request is authorized (but may fail later validation).
-
-To permit any authenticated user to do something, write a policy with the
-group property set to `"system:authenticated"`.
-
-To permit any unauthenticated user to do something, write a policy with the
-group property set to `"system:unauthenticated"`.
-
-To permit a user to do anything, write a policy with the apiGroup, namespace,
-resource, and nonResourcePath properties set to `"*"`.
-
-### Kubectl
-
-Kubectl uses the `/api` and `/apis` endpoints of api-server to negotiate
-client/server versions. To validate objects sent to the API by create/update
-operations, kubectl queries certain swagger resources. For API version `v1`
-those would be `/swaggerapi/api/v1` & `/swaggerapi/experimental/v1`.
-
-When using ABAC authorization, those special resources have to be explicitly
-exposed via the `nonResourcePath` property in a policy (see [examples](#examples) below):
-
-* `/api`, `/api/*`, `/apis`, and `/apis/*` for API version negotiation.
-* `/version` for retrieving the server version via `kubectl version`.
-* `/swaggerapi/*` for create/update operations.
-
-To inspect the HTTP calls involved in a specific kubectl operation you can turn
-up the verbosity:
-
-    kubectl --v=8 version
-
-### Examples
-
- 1. Alice can do anything to all resources:
-
-    ```json
-    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "alice", "namespace": "*", "resource": "*", "apiGroup": "*"}}
-    ```
- 2. Kubelet can read any pods:
-
-    ```json
-    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "pods", "readonly": true}}
-    ```
- 3. Kubelet can read and write events:
-
-    ```json
-    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "kubelet", "namespace": "*", "resource": "events"}}
-    ```
- 4. Bob can just read pods in namespace "projectCaribou":
-
-    ```json
-    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "bob", "namespace": "projectCaribou", "resource": "pods", "readonly": true}}
-    ```
- 5. Anyone can make read-only requests to all non-resource paths:
-
-    ```json
-    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:authenticated", "readonly": true, "nonResourcePath": "*"}}
-    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:unauthenticated", "readonly": true, "nonResourcePath": "*"}}
-    ```
-
-[Complete file example](http://releases.k8s.io/{{page.githubbranch}}/pkg/auth/authorizer/abac/example_policy_file.jsonl)
-
-### A quick note on service accounts
-
-A service account automatically generates a user. The user's name is generated
-according to the naming convention:
-
-```shell
-system:serviceaccount:<namespace>:<serviceaccountname>
-```
-Creating a new namespace also causes a new service account to be created, of
-this form:
-
-```shell
-system:serviceaccount:<namespace>:default
-```
-
-For example, if you wanted to grant the default service account in the
-kube-system full privilege to the API, you would add this line to your policy
-file:
-
-```json
-{"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"system:serviceaccount:kube-system:default","namespace":"*","resource":"*","apiGroup":"*"}}
-```
-
-The apiserver will need to be restarted to pickup the new policy lines.
-
-## RBAC Mode
-
-When specified "RBAC" (Role-Based Access Control) uses the
-"rbac.authorization.k8s.io" API group to drive authorization decisions,
-allowing admins to dynamically configure permission policies through the
-Kubernetes API.
-
-As of 1.6 RBAC mode is in beta.
-
-To enable RBAC, start the apiserver with `--authorization-mode=RBAC`.
-
-For details about administrating and using RBAC, view the [RBAC guide](/docs/admin/authorization/rbac).
-
-## Webhook Mode
-
-When specified, mode `Webhook` causes Kubernetes to query an outside REST
-service when determining user privileges.
-
-### Configuration File Format
-
-Mode `Webhook` requires a file for HTTP configuration, specify by the
-`--authorization-webhook-config-file=SOME_FILENAME` flag.
-
-The configuration file uses the [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/)
-file format. Within the file "users" refers to the API Server webhook and
-"clusters" refers to the remote service.
-
-A configuration example which uses HTTPS client auth:
-
-```yaml
-# clusters refers to the remote service.
-clusters:
-  - name: name-of-remote-authz-service
-    cluster:
-      certificate-authority: /path/to/ca.pem      # CA for verifying the remote service.
-      server: https://authz.example.com/authorize # URL of remote service to query. Must use 'https'.
-
-# users refers to the API Server's webhook configuration.
-users:
-  - name: name-of-api-server
-    user:
-      client-certificate: /path/to/cert.pem # cert for the webhook plugin to use
-      client-key: /path/to/key.pem          # key matching the cert
-
-# kubeconfig files require a context. Provide one for the API Server.
-current-context: webhook
-contexts:
- context:
-    cluster: name-of-remote-authz-service
-    user: name-of-api-server
-  name: webhook
-```
-
-### Request Payloads
-
-When faced with an authorization decision, the API Server POSTs a JSON
-serialized api.authorization.v1beta1.SubjectAccessReview object describing the
-action. This object contains fields describing the user attempting to make the
-request, and either details about the resource being accessed or requests
-attributes.
-
-Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/api/)
-as other Kubernetes API objects. Implementers should be aware of looser
-compatibility promises for beta objects and check the "apiVersion" field of the
-request to ensure correct deserialization. Additionally, the API Server must
-enable the `authorization.k8s.io/v1beta1` API extensions group (`--runtime-config=authorization.k8s.io/v1beta1=true`).
-
-An example request body:
-
-```json
-{
-  "apiVersion": "authorization.k8s.io/v1beta1",
-  "kind": "SubjectAccessReview",
-  "spec": {
-    "resourceAttributes": {
-      "namespace": "kittensandponies",
-      "verb": "get",
-      "group": "unicorn.example.org",
-      "resource": "pods"
-    },
-    "user": "jane",
-    "group": [
-      "group1",
-      "group2"
-    ]
-  }
-}
-```
-
-The remote service is expected to fill the SubjectAccessReviewStatus field of
-the request and respond to either allow or disallow access. The response body's
-"spec" field is ignored and may be omitted. A permissive response would return:
-
-```json
-{
-  "apiVersion": "authorization.k8s.io/v1beta1",
-  "kind": "SubjectAccessReview",
-  "status": {
-    "allowed": true
-  }
-}
-```
-
-To disallow access, the remote service would return:
-
-```json
-{
-  "apiVersion": "authorization.k8s.io/v1beta1",
-  "kind": "SubjectAccessReview",
-  "status": {
-    "allowed": false,
-    "reason": "user does not have read access to the namespace"
-  }
-}
-```
-
-Access to non-resource paths are sent as:
-
-```json
-{
-  "apiVersion": "authorization.k8s.io/v1beta1",
-  "kind": "SubjectAccessReview",
-  "spec": {
-    "nonResourceAttributes": {
-      "path": "/debug",
-      "verb": "get"
-    },
-    "user": "jane",
-    "group": [
-      "group1",
-      "group2"
-    ]
-  }
-}
-```
-
-Non-resource paths include: `/api`, `/apis`, `/metrics`, `/resetMetrics`,
-`/logs`, `/debug`, `/healthz`, `/swagger-ui/`, `/swaggerapi/`, `/ui`, and
-`/version.` Clients require access to `/api`, `/api/*`, `/apis`, `/apis/*`,
-and `/version` to discover what resources and versions are present on the server.
-Access to other non-resource paths can be disallowed without restricting access
-to the REST api.
-
-For further documentation refer to the authorization.v1beta1 API objects and
-plugin/pkg/auth/authorizer/webhook/webhook.go.
-
-## Module Development
-
-Other implementations can be developed fairly easily.
-The APIserver calls the Authorizer interface:
+* [Authentication](/docs/admin/authentication/) layer checks for authorization of the `impersonate` verb on `users`, `groups`, and `serviceaccounts` in the core API group, and the `userextras` in the `authentication.k8s.io` API group.
+
+## Authorization Modules
+ * **ABAC Mode** - Attribute-based access control (ABAC) defines an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together. The policies can use any type of attributes (user attributes, resource attributes, object, environment attributes etc). To learn more about using the ABAC mode, see [ABAC Mode](/docs/admin/authorization/abac/)
+ * **RBAC Mode** - Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within an enterprise. In this context, access is the ability of an individual user to perform a specific task, such as view, create, or modify a file. To learn more about using the RBAC mode, see [RBAC Mode](/docs/admin/authorization/rbac/)
+ ..* When specified "RBAC" (Role-Based Access Control) uses the "rbac.authorization.k8s.io" API group to drive authorization decisions, allowing admins to dynamically configure permission policies through the Kubernetes API.
+ ..* As of 1.6 RBAC mode is in beta.
+ ..* To enable RBAC, start the apiserver with `--authorization-mode=RBAC`.
+ * **Webhook Mode** - A WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen. To learn more about using the Webhook mode, see [Webhook Mode](/docs/admin/authorization/webhook/)
+ * **Custom Modules** - You can create custom modules for using with Kubernetes. To learn more, see **Custom Modules** below.
+ 
+### Custom Modules
+Other implementations can be developed fairly easily. The APIserver calls the Authorizer interface:

 ```go
 type Authorizer interface {
@@ -381,8 +86,7 @@ their own caching to reduce the cost of repeated authorization calls with the
 same or similar arguments.  Developers should then consider the interaction
 between caching and revocation of permissions.

-
-### Checking API Access
+#### Checking API Access

 Kubernetes exposes the `subjectaccessreviews.v1.authorization.k8s.io` resource as a
 normal resource that allows external access to API authorizer decisions.  No matter which authorizer
@@ -425,3 +129,29 @@ subjectaccessreview "" created

 This is useful for debugging access problems, in that you can use this resource
 to determine what access an authorizer is granting.
+
+## Using Flags for Your Authorization Module
+
+You must include a flag in your policy to indicate which authorization module your policies include:
+
+The following flags can be used:
+  - `--authorization-mode=ABAC` Attribute-Based Access Control (ABAC) mode allows you to configure policies using local files.
+  - `--authorization-mode=RBAC` Role-based access control (RBAC) mode allows you to create and store policies using the Kubernetes API.
+  - `--authorization-mode=Webhook` WebHook is an HTTP callback mode that allows you to manage authorization using a remote REST.
+  - `--authorization-mode=AlwaysDeny` This flag blocks all requests. Use this flag only for testing.
+  - `--authorization-mode=AlwaysAllow` This flag allows all requests. Use this flag only if you do not require authorization for your API requests.
+
+You can choose more than one authorization module. If one of the modes is `AlwaysAllow`, then it overrides the other modes and all API requests are allowed. 
+
+## Versioning
+For version 1.2, clusters created by kube-up.sh are configured so that no authorization is required for any request.
+
+As of version 1.3, clusters created by kube-up.sh are configured so that the ABAC authorization modules are enabled. However, its input file is initially set to allow all users to do all operations. The cluster administrator needs to edit that file, or configure a different authorizer to restrict what users can do.
+
+{% endcapture %}
+{% capture whatsnext %}
+* To learn more about Authentication, see **Authentication** in [Controlling Access to the Kubernetes API](/docs/admin/accessing-the-api/).
+* To learn more about Admission Control, see [Using Admission Controllers](/docs/admin/admission-controllers/).
+{% endcapture %}
+
+{% include templates/concept.md %}
@@ -168,6 +168,29 @@ rules:
  verbs: ["get", "list"]
 ```

+Resources can also be referred to by name for certain requests through the `resourceNames` list.
+When specified, requests using the "get", "delete", "update", and "patch" verbs can be restricted
+to individual instances of a resource. To restrict a subject to only "get" and "update" a single
+configmap, you would write:
+
+```yaml
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  namespace: default
+  name: configmap-updater
+rules:
+- apiGroups: [""]
+  resources: ["configmap"]
+  resourceNames: ["my-configmap"]
+  verbs: ["update", "get"]
+```
+
+Notably, if `resourceNames` are set, then the verb must not be list, watch, create, or deletecollection.
+Because resource names are not present in the URL for create, list, watch, and deletecollection API requests,
+those verbs would not be allowed by a rule with resourceNames set, since the resourceNames portion of the
+rule would not match the request.
+
 #### Role Examples

 Only the `rules` section is shown in the following examples.
@@ -225,7 +248,7 @@ Allow "GET" and "POST" requests to the non-resource endpoint "/healthz" and all

 ```yaml
 rules:
- nonResourceURLs: ["/healthz", "/healthz/*"]
+- nonResourceURLs: ["/healthz", "/healthz/*"] # '*' in a nonResourceURL is a suffix glob match
  verbs: ["get", "post"]
 ```

@@ -247,8 +270,8 @@ Group information in Kubernetes is currently provided by the Authenticator
 modules. Groups, like users, are represented as strings, and that string 
 has no format requirements, other than that the prefix `system:` is reserved.

-[Service Accounts](/docs/user-guide/service-accounts/) have usernames with the `system:serviceaccount:` prefix and belong
-to groups with the `system:serviceaccounts` prefix.
+[Service Accounts](/docs/tasks/configure-pod-container/configure-service-account/) have usernames with the `system:serviceaccount:` prefix and belong
+to groups with the `system:serviceaccounts:` prefix.

 #### Role Binding Examples

@@ -349,7 +372,7 @@ To opt out of this reconciliation, set the `rbac.authorization.kubernetes.io/aut
 annotation on a default cluster role or rolebinding to `false`.
 Be aware that missing default permissions and subjects can result in non-functional clusters.

-Auto-reconciliation is enabled in Kubernetes version 1.6+.
+Auto-reconciliation is enabled in Kubernetes version 1.6+ when the RBAC authorizer is active.

 ### Discovery Roles

@@ -394,11 +417,6 @@ When used in a <b>ClusterRoleBinding</b>, it gives full control over every resou
 When used in a <b>RoleBinding</b>, it gives full control over every resource in the rolebinding's namespace, including the namespace itself.</td>
 </tr>
 <tr>
-<td><b>cluster-status</b></td>
-<td>None</td>
-<td>Allows read-only access to basic cluster status information.</td>
-</tr>
-<tr>
 <td><b>admin</b></td>
 <td>None</td>
 <td>Allows admin access, intended to be granted within a namespace using a <b>RoleBinding</b>.
@@ -509,6 +527,8 @@ This is commonly used by add-on API servers for unified authentication and autho
 The [Kubernetes controller manager](/docs/admin/kube-controller-manager/) runs core control loops.
 When invoked with `--use-service-account-credentials`, each control loop is started using a separate service account.
 Corresponding roles exist for each control loop, prefixed with `system:controller:`.
+If the controller manager is not started with `--use-service-account-credentials`, 
+it runs all control loops using its own credential, which must be granted all the relevant roles.
 These roles include:

 * system:controller:attachdetach-controller
@@ -668,7 +688,7 @@ In order from most secure to least secure, the approaches are:
     --namespace=my-namespace
   ```

-   Many [add-ons](/docs/admin/addons/) currently run as the "default" service account in the "kube-system" namespace.
+   Many [add-ons](/docs/concepts/cluster-administration/addons/) currently run as the "default" service account in the "kube-system" namespace.
   To allow those add-ons to run with super-user access, grant cluster-admin permissions to the "default" service account in the "kube-system" namespace.
   NOTE: Enabling this means the "kube-system" namespace contains secrets that grant super-user access to the API.
   
@@ -0,0 +1,148 @@
+---
+assignees:
+- erictune
+- lavalamp
+- deads2k
+- liggitt
+title: Webhook Mode
+---
+
+{% capture overview %}
+A WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen.
+{% endcapture %}
+
+{% capture body %}
+When specified, mode `Webhook` causes Kubernetes to query an outside REST
+service when determining user privileges.
+
+## Configuration File Format
+
+Mode `Webhook` requires a file for HTTP configuration, specify by the
+`--authorization-webhook-config-file=SOME_FILENAME` flag.
+
+The configuration file uses the [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/)
+file format. Within the file "users" refers to the API Server webhook and
+"clusters" refers to the remote service.
+
+A configuration example which uses HTTPS client auth:
+
+```yaml
+# clusters refers to the remote service.
+clusters:
+  - name: name-of-remote-authz-service
+    cluster:
+      certificate-authority: /path/to/ca.pem      # CA for verifying the remote service.
+      server: https://authz.example.com/authorize # URL of remote service to query. Must use 'https'.
+
+# users refers to the API Server's webhook configuration.
+users:
+  - name: name-of-api-server
+    user:
+      client-certificate: /path/to/cert.pem # cert for the webhook plugin to use
+      client-key: /path/to/key.pem          # key matching the cert
+
+# kubeconfig files require a context. Provide one for the API Server.
+current-context: webhook
+contexts:
+- context:
+    cluster: name-of-remote-authz-service
+    user: name-of-api-server
+  name: webhook
+```
+
+## Request Payloads
+
+When faced with an authorization decision, the API Server POSTs a JSON
+serialized api.authorization.v1beta1.SubjectAccessReview object describing the
+action. This object contains fields describing the user attempting to make the
+request, and either details about the resource being accessed or requests
+attributes.
+
+Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/api/)
+as other Kubernetes API objects. Implementers should be aware of looser
+compatibility promises for beta objects and check the "apiVersion" field of the
+request to ensure correct deserialization. Additionally, the API Server must
+enable the `authorization.k8s.io/v1beta1` API extensions group (`--runtime-config=authorization.k8s.io/v1beta1=true`).
+
+An example request body:
+
+```json
+{
+  "apiVersion": "authorization.k8s.io/v1beta1",
+  "kind": "SubjectAccessReview",
+  "spec": {
+    "resourceAttributes": {
+      "namespace": "kittensandponies",
+      "verb": "get",
+      "group": "unicorn.example.org",
+      "resource": "pods"
+    },
+    "user": "jane",
+    "group": [
+      "group1",
+      "group2"
+    ]
+  }
+}
+```
+
+The remote service is expected to fill the SubjectAccessReviewStatus field of
+the request and respond to either allow or disallow access. The response body's
+"spec" field is ignored and may be omitted. A permissive response would return:
+
+```json
+{
+  "apiVersion": "authorization.k8s.io/v1beta1",
+  "kind": "SubjectAccessReview",
+  "status": {
+    "allowed": true
+  }
+}
+```
+
+To disallow access, the remote service would return:
+
+```json
+{
+  "apiVersion": "authorization.k8s.io/v1beta1",
+  "kind": "SubjectAccessReview",
+  "status": {
+    "allowed": false,
+    "reason": "user does not have read access to the namespace"
+  }
+}
+```
+
+Access to non-resource paths are sent as:
+
+```json
+{
+  "apiVersion": "authorization.k8s.io/v1beta1",
+  "kind": "SubjectAccessReview",
+  "spec": {
+    "nonResourceAttributes": {
+      "path": "/debug",
+      "verb": "get"
+    },
+    "user": "jane",
+    "group": [
+      "group1",
+      "group2"
+    ]
+  }
+}
+```
+
+Non-resource paths include: `/api`, `/apis`, `/metrics`, `/resetMetrics`,
+`/logs`, `/debug`, `/healthz`, `/swagger-ui/`, `/swaggerapi/`, `/ui`, and
+`/version.` Clients require access to `/api`, `/api/*`, `/apis`, `/apis/*`,
+and `/version` to discover what resources and versions are present on the server.
+Access to other non-resource paths can be disallowed without restricting access
+to the REST api.
+
+For further documentation refer to the authorization.v1beta1 API objects and
+[webhook.go](https://git.k8s.io/kubernetes/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/webhook.go).
+
+{% endcapture %}
+
+{% include templates/concept.md %}
@@ -14,7 +14,7 @@ creating new clusters or joining new nodes to an existing cluster.  It was built
 to support [`kubeadm`](/docs/admin/kubeadm/), but can be used in other contexts
 for users that wish to start clusters without `kubeadm`. It is also built to
 work, via RBAC policy, with the [Kubelet TLS
-Bootstrap](/docs/admin/kubelet-tls-bootstrap/) system.
+Bootstrapping](/docs/admin/kubelet-tls-bootstrapping/) system.

 Bootstrap Tokens are defined with a specific type
 (`bootstrap.kubernetes.io/token`) of secrets that lives in the `kube-system`
@@ -58,7 +58,7 @@ Authorization: Bearer 07401b.f395accd246ae52d

 Each valid token is backed by a secret in the `kube-system` namespace.  You can
 find the full design doc
-[here](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/bootstrap-discovery.md).
+[here](https://git.k8s.io/community/contributors/design-proposals/bootstrap-discovery.md).

 Here is what the secret looks like.  Note that `base64(string)` indicates the
 value should be base64 encoded.  The undecoded version is provided here for
@@ -168,4 +168,4 @@ rules (base64 encoded while discarding any trailing `=`).  That encoded payload
 is then used to form a whole JWS by inserting it between the 2 dots.  You can
 verify the JWS using the `HS256` scheme (HMAC-SHA256) with the full token (e.g.
 `07401b.f395accd246ae52d`) as the shared secret.  Users _must_ verify that HS256
-is used.
+is used.
@@ -1,9 +0,0 @@
---
-assignees:
- lavalamp
-title: Kubernetes Components
---
-
-{% include user-guide-content-moved.md %}
-
-[Kubernetes Components](/docs/concepts/overview/components/)
@@ -111,7 +111,7 @@ Heapster's resource limits are set dynamically based on the initial size of your
 and [#22940](http://issue.k8s.io/22940)). If you find that Heapster is running
 out of resources, you should adjust the formulas that compute heapster memory request (see those PRs for details).

-For directions on how to detect if addon containers are hitting resource limits, see the [Troubleshooting section of Compute Resources](/docs/user-guide/compute-resources/#troubleshooting).
+For directions on how to detect if addon containers are hitting resource limits, see the [Troubleshooting section of Compute Resources](/docs/concepts/configuration/manage-compute-resources-container/#troubleshooting).

 In the [future](http://issue.k8s.io/13048), we anticipate to set all cluster addon resource limits based on cluster size, and to dynamically adjust them if you grow or shrink your cluster.
 We welcome PRs that implement those features.
@@ -1,9 +0,0 @@
---
-assignees:
- davidopp
-title: Pod Disruption Budget
---
-
-{% include user-guide-content-moved.md %}
-
-[Configuring a Pod Disruption Budget](/docs/tasks/configure-pod-container/configure-pod-disruption-budget/)
@@ -1,10 +0,0 @@
---
-assignees:
- davidopp
- thockin
-title: Using DNS Pods and Services
---
-
-{% include user-guide-content-moved.md %}
-
-[DNS Pods and Services](/docs/concepts/services-networking/dns-pod-service/)
@@ -1,49 +0,0 @@
---
-assignees:
- lavalamp
-title: Configuring Kubernetes Use of etcd
---
-
-[etcd](https://coreos.com/etcd/docs/latest/) is a highly-available key value
-store which Kubernetes uses for persistent storage of all of its REST API
-objects.
-
-## Configuration: high-level goals
-
-Access Control: give *only* kube-apiserver read/write access to etcd. You do not
-want apiserver's etcd exposed to every node in your cluster (or worse, to the
-internet at large), because access to etcd is equivalent to root in your
-cluster.
-
-Data Reliability: for reasonable safety, either etcd needs to be run as a
-[cluster](/docs/admin/high-availability/#clustering-etcd) (multiple machines each running
-etcd) or etcd's data directory should be located on durable storage (e.g., GCE's
-persistent disk). In either case, if high availability is required--as it might
-be in a production cluster--the data directory ought to be [backed up
-periodically](https://coreos.com/etcd/docs/latest/op-guide/recovery.html),
-to reduce downtime in case of corruption.
-
-## Default configuration
-
-The default setup scripts use kubelet's file-based static pods feature to run etcd in a
-[pod](http://releases.k8s.io/{{page.githubbranch}}/cluster/saltbase/salt/etcd/etcd.manifest). This manifest should only
-be run on master VMs. The default location that kubelet scans for manifests is
-`/etc/kubernetes/manifests/`.
-
-## Kubernetes's usage of etcd
-
-By default, Kubernetes objects are stored under the `/registry` key in etcd.
-This path can be prefixed by using the [kube-apiserver](/docs/admin/kube-apiserver) flag
-`--etcd-prefix="/foo"`.
-
-`etcd` is the only place that Kubernetes keeps state.
-
-## Troubleshooting
-
-To test whether `etcd` is running correctly, you can try writing a value to a
-test key. On your master VM (or somewhere with firewalls configured such that
-you can talk to your cluster's etcd), try:
-
-```shell
-curl -fs -X PUT "http://${host}:${port}/v2/keys/_test"
-```
@@ -1,214 +0,0 @@
---
-assignees:
- mml
- wojtek-t
-title: Upgrading and Rolling Back etcd
---
-
-## About etcd
-
-[etcd](https://coreos.com/etcd/docs/latest/) is a highly-available key value
-store, which Kubernetes uses for persistent storage of all of its REST API
-objects.
-
-<!-- TODO(mml): Write this doc.
-
-For the mechanics behind how kubernetes builds, distributes and deploys etcd,
-see _some doc_.
-
-->
-
-### Important assumptions
-
-The upgrade procedure described in this document assumes that either:
-
-1. The etcd cluster has only a single node, or
-1. The etcd cluster has multiple nodes. In this case, the upgrade procedure requires shutting down the
-   etcd cluster. During the time the etcd cluster is shutdown, the Kubernetes API Server
-   will be read only.
-
-**Warning**: Deviations from the assumptions are untested by continuous
-integration, and deviations might create undesirable consequences. Additional
-information about operating an etcd cluster is available [from the etcd
-maintainers](https://github.com/coreos/etcd/tree/master/Documentation).
-
-### etcd for Kubernetes: high-level goals
-
-Access control: Give only kube-apiserver read/write access to etcd. You do not
-want the API server's etcd exposed to every node in your cluster, or worse, to the
-internet at large. Access to etcd is equivalent to root access in your
-cluster.
-
-Data reliability: For reasonable safety, either etcd needs to be run as a
-[cluster](/docs/admin/high-availability/#clustering-etcd), or etcd's data directory
-should be located on durable storage, for example, a Google Compute Engine persistent disk.
-In either case, if high availability is
-required--as it might be in a production cluster--the data directory ought to be
-[backed up periodically](https://coreos.com/etcd/docs/latest/op-guide/recovery.html)
-to reduce downtime in case of corruption.
-
-## Background
-
-As of Kubernetes version 1.5.1, we are still using etcd from the 2.2.1 release with
-the v2 API. Also, we have no pre-existing process for updating etcd, as we have
-never updated etcd by either minor or major version.
-
-Note that we need to migrate both the etcd versions that we are using (from 2.2.1
-to at least 3.0.x) as well as the version of the etcd API that Kubernetes talks to. The etcd 3.0.x
-binaries support both the v2 and v3 API.
-
-This document describes how to do this migration.  If you want to skip the
-background and cut right to the procedure, see [Upgrade
-Procedure](#upgrade-procedure).
-
-### etcd upgrade requirements
-
-There are requirements on how an etcd cluster upgrade can be performed. The primary considerations are:
- Upgrade between one minor release at a time
- Rollback supported through additional tooling
-
-#### One minor release at a time
-
-Upgrade only one minor release at a time. For example, we cannot upgrade directly from 2.1.x to 2.3.x.
-Within patch releases it is possible to upgrade and downgrade between arbitrary versions. Starting a cluster for 
-any intermediate minor release, waiting until the cluster is healthy, and then
-shutting down the cluster down will perform the migration. For example, to upgrade from version 2.1.x to 2.3.y, 
-it is enough to start etcd in 2.2.z version, wait until it is healthy, stop it, and then start the
-2.3.y version.
-
-#### Rollback via additional tooling
-
-Versions 3.0+ of etcd do not support general rollback. That is,
-after migrating from M.N to M.N+1, there is no way to go back to M.N.
-The etcd team has provided a [custom rollback tool](https://github.com/kubernetes/kubernetes/tree/master/cluster/images/etcd/rollback)
-but the rollback tool has these limitations:
-
-* This custom rollback tool is not part of the etcd repo and does not receive the same
-  testing as the rest of etcd.  We are testing it in a couple of end-to-end tests.
-  There is only community support here.
-
-* The rollback can be done only from the 3.0.x version (that is using the v3 API) to the
-  2.2.1 version (that is using the v2 API).
-
-* The tool only works if the data is stored in `application/json` format.
-
-* Rollback doesn’t preserve resource versions of objects stored in etcd.
-
-**Warning**: If the data is not kept in `application/json` format (see [Upgrade
-Procedure](#upgrade-procedure)), you will lose the option to roll back to etcd
-2.2.
-
-The last bullet means that any component or user that has some logic
-depending on resource versions may require restart after etcd rollback. This
-includes that all clients using the watch API, which depends on
-resource versions. Since both the kubelet and kube-proxy use the watch API, a
-rollback might require restarting all Kubernetes components on all nodes.
-
-**Note**: At the time of writing, both Kubelet and KubeProxy are using “resource
-version” only for watching (i.e. are not using resource versions for anything
-else). And both are using reflector and/or informer frameworks for watching
-(i.e.  they don’t send watch requests themselves). Both those frameworks if they
-can’t renew watch, they will start from “current version” by doing “list + watch
-from the resource version returned by list”. That means that if the apiserver
-will be down for the period of rollback, all of node components should basically
-restart their watches and start from “now” when apiserver is back. And it will
-be back with new resource version. That would mean that restarting node
-components is not needed.  But the assumptions here may not hold forever.
-
-## Design
-
-This section describes how we are going to do the migration, given the
-[etcd upgrade requirements](#etcd-upgrade-requirements).
-
-Note that because the code changes in Kubernetes code needed
-to support the etcd v3 API are local and straightforward, we do not
-focus on them at all. We focus only on the upgrade/rollback here.
-
-### New etcd Docker image
-
-We decided to completely change the the content of the etcd image and the way it works.
-So far, the Docker image for etcd  in version X has contained only the etcd and
-etcdctl binaries.
-
-Going forward, the Docker image for etcd in version X will contain multiple
-versions of etcd. For example, the 3.0.17 image will contain the 2.2.1, 2.3.7, and
-3.0.17 binaries of etcd and etcdctl. This will allow running etcd in multiple
-different versions using the same Docker image.
-
-Additionally, the image will contain a custom script, written by the Kubernetes team,
-for doing migration between versions. The image will also contain the rollback tool
-provided by the etcd team.
-
-### Migration script
-The migration script that will be part of the etcd Docker image is a bash
-script that works as follows:
-
-1. Detect which version of etcd we were previously running.
-   For that purpose, we have added a dedicated file, `version.txt`, that
-   holds that information and is stored in the etcd-data-specific directory,
-   next to the etcd data. If the file doesn’t exist, we default it to version 2.2.1.
-1. If we are in version 2.2.1 and are supposed to upgrade, backup
-   data.
-1. Based on the detected previous etcd version and the desired one
-   (communicated via environment variable), do the upgrade steps as
-   needed. This means that for every minor etcd release greater than the detected one and
-   less than or equal to the desired one:
-   1. Start etcd in that version.
-   1. Wait until it is healthy. Healthy means that you can write some data to it.
-   1. Stop this etcd. Note that this etcd will not listen on the default
-   etcd port. It is hard coded to listen on ports that the API server is not
-   configured to connect to, which means that API server won’t be able to connect
-   to it. Assuming no other client goes out of its way to try to
-   connect and write to this obscure port, no new data will be written during
-   this period.
-1. If the desired API version is v3 and the detected version is v2, do the offline
-   migration from the v2 to v3 data format. For that we use two tools:
-   * ./etcdctl migrate: This is the official tool for migration provided by the etcd team.
-   * A custom script that is attaching TTLs to events in the etcd. Note that etcdctl
-      migrate doesn’t support TTLs.
-1. After every successful step, update contents of the version file.
-   This will protect us from the situation where something crashes in the
-   meantime ,and the version file gets completely unsynchronized with the
-   real data. Note that it is safe if the script crashes after the step is
-   done and before the file is updated. This will only result in redoing one
-   step in the next try.
-
-All the previous steps are for the case where the detected version is less than or
-equal to the desired version. In the opposite case, that is for a rollback, the
-script works as follows:
-
-1. Verify that the detected version is 3.0.x with the v3 API, and the
-   desired version is 2.2.1 with the v2 API. We don’t support any other rollback.
-1. If so, we run the custom tool provided by etcd team to do the offline
-   rollback.  This tool reads the v3 formatted data and writes it back to disk
-   in v2 format.
-1. Finally update the contents of the version file.
-
-### Upgrade procedure
-Simply modify the command line in the etcd manifest to:
-
-1. Run the migration script. If the previously run version is already in the
-   desired version, this will be no-op.
-1. Start etcd in the desired version.
-
-Starting in Kubernetes version 1.6, this has been done in the manifests for new
-Google Compute Engine clusters. You should also specify these environment
-variables.  In particular,you must keep `STORAGE_MEDIA_TYPE` set to
-`application/json` if you wish to preserve the option to roll back.
-
-```
-TARGET_STORAGE=etcd3
-ETCD_IMAGE=3.0.17
-TARGET_VERSION=3.0.17
-STORAGE_MEDIA_TYPE=application/json
-```
-
-To roll back, use these:
-
-```
-TARGET_STORAGE=etcd2
-ETCD_IMAGE=3.0.17
-TARGET_VERSION=2.2.1
-STORAGE_MEDIA_TYPE=application/json
-```
-
@@ -129,7 +129,7 @@ $ federation/deploy/deploy.sh deploy_federation
 ```

 This spins up the federation control components as pods managed by
-[`Deployments`](http://kubernetes.io/docs/user-guide/deployments/) on your
+[`Deployments`](/docs/concepts/workloads/controllers/deployment/) on your
 existing Kubernetes cluster. It also starts a
 [`type: LoadBalancer`](http://kubernetes.io/docs/user-guide/services/#type-loadbalancer)
 [`Service`](http://kubernetes.io/docs/user-guide/services/) for the
@@ -385,4 +385,4 @@ if required.

 ## For more information

- * [Federation proposal](https://github.com/kubernetes/kubernetes/blob/{{page.githubbranch}}/docs/proposals/federation.md) details use cases that motivated this work.
+ * [Federation proposal](https://git.k8s.io/community/contributors/design-proposals/federation.md) details use cases that motivated this work.
@@ -1,9 +0,0 @@
---
-assignees:
- madhusudancs
-title: Setting up Cluster Federation with Kubefed
---
-
-{% include user-guide-content-moved.md %}
-
-[Setting up Cluster Federation with kubefed](/docs/tutorials/federation/set-up-cluster-federation-kubefed/)
@@ -4,5 +4,5 @@ MASTER_IP=<insert-ip-here>
 DNS_IP=<insert-dns-ip-here>

 DAEMON_ARGS="$DAEMON_ARGS --api-servers=https://${MASTER_IP} --enable-debugging-handlers=true  --cloud-provider=
-gce --config=/etc/kubernetes/manifests --allow-privileged=False --v=2 --cluster-dns=${DNS_IP} --cluster-domain=c
+gce --pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=False --v=2 --cluster-dns=${DNS_IP} --cluster-domain=c
 luster.local   --configure-cbr0=true --cgroup-root=/ --system-container=/system "
@@ -1,12 +1,12 @@
---
-title: Building High-Availability Clusters
---
-
+---
+title: Building High-Availability Clusters
+---
+
 ## Introduction

 This document describes how to build a high-availability (HA) Kubernetes cluster.  This is a fairly advanced topic.
-Users who merely want to experiment with Kubernetes are encouraged to use configurations that are simpler to set up such as
-the simple [Docker based single node cluster instructions](/docs/getting-started-guides/docker),
+Users who merely want to experiment with Kubernetes are encouraged to use configurations that are simpler to set up such
+as [Minikube](/docs/getting-started-guides/minikube/)
 or try [Google Container Engine](https://cloud.google.com/container-engine/) for hosted Kubernetes.

 Also, at this time high availability support for Kubernetes is not continuously tested in our end-to-end (e2e) testing.  We will
@@ -17,7 +17,7 @@ be working to add this continuous testing, but for now the single-node master in

 ## Overview

-Setting up a truly reliable, highly available distributed system requires a number of steps, it is akin to
+Setting up a truly reliable, highly available distributed system requires a number of steps. It is akin to
 wearing underwear, pants, a belt, suspenders, another pair of underwear, and another pair of pants.  We go into each
 of these steps in detail, but a summary is given here to help guide and orient the user.

@@ -63,7 +63,6 @@ If you are using monit, you should also install the monit daemon (`apt-get insta

 On systemd systems you `systemctl enable kubelet` and `systemctl enable docker`.

-
 ## Establishing a redundant, reliable data storage layer

 The central foundation of a highly available solution is a redundant, reliable storage layer.  The number one rule of high-availability is
@@ -97,7 +96,6 @@ Note that in `etcd.yaml` you should substitute the token URL you got above for `
 and you should substitute a different name (e.g. `node-1`) for `${NODE_NAME}` and the correct IP address
 for `${NODE_IP}` on each machine.

-
 #### Validating your cluster

 Once you copy this into all three nodes, you should have a clustered etcd set up.  You can validate on master with
@@ -130,7 +128,6 @@ Regardless of how you choose to implement it, if you chose to use one of these o
 to each machine.  If your storage is shared between the three masters in your cluster, you should create a different directory on the storage
 for each node.  Throughout these instructions, we assume that this storage is mounted to your machine in `/var/etcd/data`

-
 ## Replicated API Servers

 Once you have replicated etcd set up correctly, we will also install the apiserver using the kubelet.
@@ -184,9 +181,9 @@ cluster state, such as the controller manager and scheduler.  To achieve this re
 instances of these actors, in case a machine dies.  To achieve this, we are going to use a lease-lock in the API to perform
 master election.  We will use the `--leader-elect` flag for each scheduler and controller-manager, using a lease in the API will ensure that only 1 instance of the scheduler and controller-manager are running at once.

-The scheduler and controller-manager can be configured to talk to the API server that is on the same node (i.e. 127.0.0.1), or it can be configured to communicate using the load balanced IP address of the API servers. Regardless of how they are configured, the scheduler and controller-manager will complete the leader election process mentioned above when using the `--leader-elect` flag. 
+The scheduler and controller-manager can be configured to talk to the API server that is on the same node (i.e. 127.0.0.1), or it can be configured to communicate using the load balanced IP address of the API servers. Regardless of how they are configured, the scheduler and controller-manager will complete the leader election process mentioned above when using the `--leader-elect` flag.

-In case of a failure accessing the API server, the elected leader will not be able to renew the lease, causing a new leader to be elected. This is especially relevant when configuring the scheduler and controller-manager to access the API server via 127.0.0.1, and the API server on the same node is unavailable. 
+In case of a failure accessing the API server, the elected leader will not be able to renew the lease, causing a new leader to be elected. This is especially relevant when configuring the scheduler and controller-manager to access the API server via 127.0.0.1, and the API server on the same node is unavailable.

 ### Installing configuration files

@@ -1,7 +0,0 @@
---
-title: Admin Guide
---
-
-{% include user-guide-content-moved.md %}
-
-[Cluster Administration Overview](/docs/tasks/administer-cluster/overview/)
@@ -0,0 +1,63 @@
+---
+title: kube-scheduler
+notitle: true
+---
+
+## kube-scheduler
+
+
+
+### Synopsis
+
+
+The Kubernetes scheduler is a policy-rich, topology-aware,
+workload-specific function that significantly impacts availability, performance,
+and capacity. The scheduler needs to take into account individual and collective
+resource requirements, quality of service requirements, hardware/software/policy
+constraints, affinity and anti-affinity specifications, data locality, inter-workload
+interference, deadlines, and so on. Workload-specific requirements will be exposed
+through the API as necessary.
+
+```
+kube-scheduler
+```
+
+### Options
+
+```
+      --address string                           The IP address to serve on (set to 0.0.0.0 for all interfaces) (default "0.0.0.0")
+      --algorithm-provider string                The scheduling algorithm provider to use, one of: DefaultProvider | ClusterAutoscalerProvider (default "DefaultProvider")
+      --failure-domains string                   Indicate the "all topologies" set for an empty topologyKey when it's used for PreferredDuringScheduling pod anti-affinity. (default "kubernetes.io/hostname,failure-domain.beta.kubernetes.io/zone,failure-domain.beta.kubernetes.io/region")
+      --feature-gates value                      A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+AllAlpha=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+AppArmor=true|false (BETA - default=true)
+DynamicKubeletConfig=true|false (ALPHA - default=false)
+DynamicVolumeProvisioning=true|false (ALPHA - default=true)
+      --google-json-key string                   The Google Cloud Platform Service Account JSON Key to use for authentication.
+      --hard-pod-affinity-symmetric-weight int   RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule corresponding to every RequiredDuringScheduling affinity rule. --hard-pod-affinity-symmetric-weight represents the weight of implicit PreferredDuringScheduling affinity rule. (default 1)
+      --kube-api-burst value                     Burst to use while talking with kubernetes apiserver (default 100)
+      --kube-api-content-type string             Content type of requests sent to apiserver. (default "application/vnd.kubernetes.protobuf")
+      --kube-api-qps value                       QPS to use while talking with kubernetes apiserver (default 50)
+      --kubeconfig string                        Path to kubeconfig file with authorization and master location information.
+      --leader-elect                             Start a leader election client and gain leadership before executing the main loop. Enable this when running replicated components for high availability. (default true)
+      --leader-elect-lease-duration duration     The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled. (default 15s)
+      --leader-elect-renew-deadline duration     The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled. (default 10s)
+      --leader-elect-retry-period duration       The duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled. (default 2s)
+      --master string                            The address of the Kubernetes API server (overrides any value in kubeconfig)
+      --policy-config-file string                File with scheduler policy configuration
+      --port value                               The port that the scheduler's http service runs on (default 10251)
+      --profiling                                Enable profiling via web interface host:port/debug/pprof/ (default true)
+      --scheduler-name string                    Name of the scheduler, used to select which pods will be processed by this scheduler, based on pod's annotation with key 'scheduler.alpha.kubernetes.io/name' (default "default-scheduler")
+```
+
+###### Auto generated by spf13/cobra on 24-Oct-2016
+
+
+
+
+
+
+<!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
+[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/admin/kube-scheduler.md?pixel)]()
+<!-- END MUNGE: GENERATED_ANALYTICS -->
@@ -4,7 +4,7 @@ assignees:
 - luxas
 - errordeveloper
 - jbeda
-title: kubeadm reference
+title: kubeadm Setup Tool
 ---

 This document provides information on how to use kubeadm's advanced options.
@@ -23,7 +23,9 @@ following steps:

 1. kubeadm generates a self-signed CA to provision identities for each component
   (including nodes) in the cluster.  It also generates client certificates to
-   be used by various components.
+   be used by various components.  If the user has provided their own CA by
+   dropping it in the cert directory (configured via `--cert-dir`, by default
+   `/etc/kubernetes/pki`), this step is skipped.

 1. Outputting a kubeconfig file for the kubelet to use to connect to the API
   server, as well as an additional kubeconfig file for administration.
@@ -38,8 +40,8 @@ following steps:
   run there.  It also sets up the RBAC authorization system and writes a
   special ConfigMap that is used to bootstrap trust with the kubelets.

-1. kubeadm installs installs add-on components via the API server.  Right now
-   this is the internal DNS server and the kube-proxy DaemonSet.
+1. kubeadm installs add-on components via the API server.  Right now this is
+   the internal DNS server and the kube-proxy DaemonSet.

 Running `kubeadm join` on each node in the cluster consists of the following
 steps:
@@ -70,7 +72,7 @@ It is usually sufficient to run `kubeadm init` without any flags, but in some
 cases you might like to override the default behaviour. Here we specify all the
 flags that can be used to customise the Kubernetes installation.

- `--api-advertise-address`
+- `--apiserver-advertise-address`

 This is the address the API Server will advertise to other members of the
 cluster.  This is also the address used to construct the suggested `kubeadm
@@ -105,6 +107,19 @@ A kubeadm specific [config file](#config-file).  This can be used to specify an
 extended set of options including passing arbitrary command line flags to the
 control plane components.

+**Note**: When providing configuration values using _both_ a configuration file
+and flags, the file will take precedence. For example, if a file exists with:
+
+```yaml
+apiVersion: kubeadm.k8s.io/v1alpha1
+kind: MasterConfiguration
+token: 1234
+```
+
+and the user ran `kubeadm init --config file.yaml --token 5678`,
+the chosen token value will be `1234`.
+
+
 - `--kubernetes-version` (default 'latest') the kubernetes version to initialise

 The **v1.6** version of kubeadm only supports building clusters that are at
@@ -141,6 +156,16 @@ names `<service_name>.<namespace>.svc.cluster.local`. You can use the
 update the `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` file
 accordingly else DNS will not function correctly.

+**Note**: This flag has an effect (it's needed for the kube-dns Deployment
+manifest and the API Server's serving certificate) but not as you might expect,
+since you will have to modify the arguments to the kubelets in the cluster for
+it to work fully. Specifying DNS parameters using this flag only is not enough.
+Rewriting the kubelet's CLI arguments is out of scope for kubeadm as it should
+be agnostic to how you run the kubelet. However, making all kubelets in the
+cluster pick up information dynamically via the API _is_ in scope and is a
+[planned feature](https://github.com/kubernetes/kubeadm/issues/28) for upcoming
+releases.
+
 - `--skip-preflight-checks`

 By default, kubeadm runs a series of preflight checks to validate the system
@@ -277,7 +302,9 @@ networking:
  podSubnet: <cidr>
 kubernetesVersion: <string>
 cloudProvider: <string>
-authorizationMode: <string>
+authorizationModes:
+- <authorizationMode1|string>
+- <authorizationMode2|string>
 token: <string>
 tokenTTL: <time duration>
 selfHosted: <bool>
@@ -295,6 +322,8 @@ apiServerCertSANs:
  - <name2|string>
 certificatesDir: <string>
 ```
+In addition, if authorizationMode is set to `ABAC`, you should write the config to `/etc/kubernetes/abac_policy.json`.
+However, if authorizationMode is set to `Webhook`, you should write the config to `/etc/kubernetes/webhook_authz.conf`.

 ### Sample Node Configuration

@@ -327,7 +356,7 @@ commands.
 * `kubeadm token create` Creates a new token.
    * `--description` Set the description on the new token.
    * `--ttl duration` Set expiration time of the token as a delta from "now".
-      Default is 0 for no expiration.
+      Default is 0 for no expiration. The unit of the duration is seconds.
    * `--usages` Set the ways that the token can be used.  The default is
      `signing,authentication`.  These are the usages as described above.
 * `kubeadm token delete <token id>|<token id>.<token secret>` Delete a token.
@@ -346,7 +375,7 @@ docs](/docs/admin/bootstrap-tokens/).
 ## Automating kubeadm

 Rather than copying the token you obtained from `kubeadm init` to each node, as
-in the [basic kubeadm tutorial](docs/getting-started-guides/kubeadm/), you can
+in the [basic kubeadm tutorial](/docs/admin/kubeadm/), you can
 parallelize the token distribution for easier automation. To implement this
 automation, you must know the IP address that the master will have after it is
 started.
@@ -378,11 +407,25 @@ configuration file.
 | Variable | Default | Description |
 | --- | --- | --- |
 | `KUBE_KUBERNETES_DIR` | `/etc/kubernetes` | Where most configuration files are written to and read from |
-| `KUBE_HOST_ETCD_PATH` | `/var/lib/etcd` | Local etcd state for Kubernetes cluster |
 | `KUBE_HYPERKUBE_IMAGE` | | If set, use a single hyperkube image with this name. If not set, individual images per server component will be used. |
 | `KUBE_ETCD_IMAGE` | `gcr.io/google_containers/etcd-<arch>:3.0.17` | The etcd container image to use. |
 | `KUBE_REPO_PREFIX` | `gcr.io/google_containers` | The image prefix for all images that are used. |

+If `KUBE_KUBERNETES_DIR` is specified, you may need to rewrite the arguments of the kubelet.
+(e.g. --kubeconfig, --pod-manifest-path)
+
+If `KUBE_REPO_PREFIX` is specified, you may need to set the kubelet flag `--pod-infra-container-image` which specifies which pause image to use.
+Defaults to `gcr.io/google_containers/pause-${ARCH}:3.0` where `${ARCH}` can be one of `amd64`, `arm`, `arm64`, `ppc64le` or `s390x`.
+
+```bash
+cat > /etc/systemd/system/kubelet.service.d/20-pod-infra-image.conf <<EOF
+[Service]
+Environment="KUBELET_EXTRA_ARGS=--pod-infra-container-image=<your-image>"
+EOF
+systemctl daemon-reload
+systemctl restart kubelet
+```
+
 If you want to use kubeadm with an http proxy, you may need to configure it to
 support http_proxy, https_proxy, or no_proxy.

@@ -403,11 +446,53 @@ export no_proxy="localhost,127.0.0.1,localaddress,.localdomain.com,example.com,1
 Remember to change `proxy_ip` and add a kube master node IP address to
 `no_proxy`.

+## Use Kubeadm with other CRI runtimes
+
+Since [Kubernetes 1.6 release](https://git.k8s.io/kubernetes/CHANGELOG.md#node-components-1), Kubernetes container runtimes have been transferred to using CRI by default. Currently, the build-in container runtime is Docker which is enabled by build-in `dockershim` in `kubelet`.
+
+Using other CRI based runtimes with kubeadm is very simple, and currently supported runtimes are:
+
+- [cri-o](https://github.com/kubernetes-incubator/cri-o)
+- [frakti](https://github.com/kubernetes/frakti)
+- [rkt](https://github.com/kubernetes-incubator/rktlet)
+
+After you have successfully installed `kubeadm` and `kubelet`, please follow these two steps:
+
+1. Install runtime shim on every node. You will need to follow the installation document in the runtime shim project listing above.
+
+2. Configure kubelet to use remote CRI runtime. Please remember to change `RUNTIME_ENDPOINT` to your own value like `/var/run/{your_runtime}.sock`:
+
+```shell
+  $ cat > /etc/systemd/system/kubelet.service.d/20-cri.conf <<EOF
+Environment="KUBELET_EXTRA_ARGS=--container-runtime=remote --container-runtime-endpoint=$RUNTIME_ENDPOINT --feature-gates=AllAlpha=true"
+EOF
+  $ systemctl daemon-reload
+```
+
+Now `kubelet` is ready to use the specified CRI runtime, and you can continue with `kubeadm init` and `kubeadm join` workflow to deploy Kubernetes cluster.
+
+## Using custom certificates
+
+By default kubeadm will generate all the certificates needed for a cluster to run.
+You can override this behaviour by providing your own certificates.
+
+To do so, you must place them in whatever directory is specified by the
+`--cert-dir` flag or `CertificatesDir` configuration file key. By default this
+is `/etc/kubernetes/pki`.
+
+If a given certificate and private key pair both exist, kubeadm will skip the
+generation step and those files will be validated and used for the prescribed
+use-case.
+
+This means you can, for example, prepopulate `/etc/kubernetes/pki/ca.crt`
+and `/etc/kubernetes/pki/ca.key` with an existing CA, which then will be used
+for signing the rest of the certs.
+
 ## Releases and release notes

 If you already have kubeadm installed and want to upgrade, run `apt-get update
 && apt-get upgrade` or `yum update` to get the latest version of kubeadm.

 Refer to the
-[CHANGELOG.md](https://github.com/kubernetes/kubeadm/blob/master/CHANGELOG.md)
+[CHANGELOG.md](https://git.k8s.io/kubeadm/CHANGELOG.md)
 for more information.
@@ -10,87 +10,87 @@ title: TLS bootstrapping
 ## Overview

 This document describes how to set up TLS client certificate bootstrapping for kubelets.
-Kubernetes 1.4 introduces an experimental API for requesting certificates from a cluster-level 
-Certificate Authority (CA). The first supported use of this API is the provisioning of TLS client 
-certificates for kubelets. The proposal can be found [here](https://github.com/kubernetes/kubernetes/pull/20439)
-and progress on the feature is being tracked as [feature #43](https://github.com/kubernetes/features/issues/43). 
+Kubernetes 1.4 introduced an API for requesting certificates from a cluster-level Certificate Authority (CA). The original intent of this API is to enable provisioning of TLS client certificates for kubelets. The proposal can be found [here](https://github.com/kubernetes/kubernetes/pull/20439)
+and progress on the feature is being tracked as [feature #43](https://github.com/kubernetes/features/issues/43).

-## apiserver configuration
+## kube-apiserver configuration

 You must provide a token file which specifies at least one "bootstrap token" assigned to a kubelet bootstrap-specific group.
 This group will later be used in the controller-manager configuration to scope approvals in the default approval
-controller. As this feature matures, you should ensure tokens are bound to an RBAC policy which limits requests
-using the bootstrap token to only be able to make requests related to certificate provisioning. When RBAC policy
-is in place, scoping the tokens to a group will allow great flexibility (e.g. you could disable a particular
-bootstrap group's access when you are done provisioning the nodes). 
+controller. As this feature matures, you should ensure tokens are bound to a Role-Based Access Control (RBAC) policy which limits requests
+(using the bootstrap token) strictly to client requests related to certificate provisioning. With RBAC in place, scoping the tokens to a group allows for great flexibility (e.g. you could disable a particular bootstrap group's access when you are done provisioning the nodes).

-### Token auth file 
-Tokens are arbitrary but should represent at least 128 bits of entropy derived from a secure random number 
-generator (such as /dev/urandom on most modern systems). There are multiple ways you can generate a token. For example: 
+### Token authentication file
+Tokens are arbitrary but should represent at least 128 bits of entropy derived from a secure random number
+generator (such as /dev/urandom on most modern systems). There are multiple ways you can generate a token. For example:

-`head -c 16 /dev/urandom | od -An -t x | tr -d ' '` 
+`head -c 16 /dev/urandom | od -An -t x | tr -d ' '`

-will generate tokens that look like `02b50b05283e98dd0fd71db496ef01e8` 
+will generate tokens that look like `02b50b05283e98dd0fd71db496ef01e8`

-The token file will look like the following example, where the first three values can be anything and the quoted group 
-name should be as depicted: 
+The token file should look like the following example, where the first three values can be anything and the quoted group
+name should be as depicted:

 ```
 02b50b05283e98dd0fd71db496ef01e8,kubelet-bootstrap,10001,"system:kubelet-bootstrap"
-``` 
+```

-Add the `--token-auth-file=FILENAME` flag to the apiserver command to enable the token file. 
-See docs at http://kubernetes.io/docs/admin/authentication/#static-token-file for further details.
+Add the `--token-auth-file=FILENAME` flag to the kube-apiserver command (in your systemd unit file perhaps) to enable the token file.
+See docs [here](http://kubernetes.io/docs/admin/authentication/#static-token-file) for further details.

 ### Client certificate CA bundle

-Add the `--client-ca-file=FILENAME` flag to the apiserver command to enable client certificate authentication,
-referencing a certificate authority bundle containing the signing certificate.
+Add the `--client-ca-file=FILENAME` flag to the kube-apiserver command to enable client certificate authentication,
+referencing a certificate authority bundle containing the signing certificate (e.g. `--client-ca-file=/var/lib/kubernetes/ca.pem`).

-## controller-manager configuration
-The API for requesting certificates adds a certificate-issuing control loop to the KCM. This takes the form of a 
-[cfssl](https://blog.cloudflare.com/introducing-cfssl/) local signer using assets on disk. 
-Currently, all certificates issued have one year validity and a default set of key usages. 
+## kube-controller-manager configuration
+The API for requesting certificates adds a certificate-issuing control loop to the Kubernetes Controller Manager. This takes the form of a
+[cfssl](https://blog.cloudflare.com/introducing-cfssl/) local signer using assets on disk. Currently, all certificates issued have one year validity and a default set of key usages.

-### Signing assets 
-You must provide a Certificate Authority in order to provide the cryptographic materials necessary to issue certificates. 
-This CA should be trusted by the apiserver for authentication with the `--client-ca-file=SOMEFILE` flag. The management
+### Signing assets
+You must provide a Certificate Authority in order to provide the cryptographic materials necessary to issue certificates.
+This CA should be trusted by kube-apiserver for authentication with the `--client-ca-file=FILENAME` flag. The management
 of the CA is beyond the scope of this document but it is recommended that you generate a dedicated CA for Kubernetes.
-Both certificate and key are assumed to be PEM-encoded. 
+Both certificate and key are assumed to be PEM-encoded.
+
+The kube-controller-manager flags are:

-The new controller-manager flags are: 
 ```
 --cluster-signing-cert-file="/etc/path/to/kubernetes/ca/ca.crt" --cluster-signing-key-file="/etc/path/to/kubernetes/ca/ca.key"
-``` 
+```

-### Auto-approval 
-To ease deployment and testing, the alpha version of the certificate request API includes a flag to approve all certificate 
+### Automatic approval
+To ease deployment and testing, there is an experimental flag in the certificate bootstrapping API to approve all certificate
 requests made by users in a certain group. The intended use of this is to whitelist only the group corresponding to the bootstrap
-token in the token file above. Use of this flag circumvents makes the "approval" process described below and is not recommended
-for production use. 
+token in the token file above. Use of this flag circumvents the approval process described below and is not recommended
+for production use.
+
+The flag is:

-The flag is: 
 ```
 --insecure-experimental-approve-all-kubelet-csrs-for-group="system:kubelet-bootstrap"
-``` 
+```

-## kubelet configuration 
-To use request a client cert from the certificate request API, the kubelet needs a path to a kubeconfig file that contains the
-bootstrap auth token. If the file specified by `--kubeconfig` does not exist, the bootstrap kubeconfig is used to request a
-client certificate from the API server. On success, a kubeconfig file referencing the generated key and obtained certificate
-is written to the path specified by `--kubeconfig`. The certificate and key file will be stored in the directory pointed 
-by `--cert-dir`.  The new flag is: 
+## kubelet configuration
+To request a client certificate from kube-apiserver, the kubelet first needs a path to a kubeconfig file that contains the
+bootstrap authentication token. You can use `kubectl config set-cluster`, `set-credentials`, and `set-context` to build this kubeconfig. Provide the name `kubelet-bootstrap` to `kubectl config set-credentials` and include `--token=<token-value>` as follows:
+
+```
+kubectl config set-credentials kubelet-bootstrap --token=${BOOTSTRAP_TOKEN} --kubeconfig=bootstrap.kubeconfig
+```
+
+When starting the kubelet, if the file specified by `--kubeconfig` does not exist, the bootstrap kubeconfig is used to request a client certificate from the API server. On approval of the certificate request and receipt back by the kubelet, a kubeconfig file referencing the generated key and obtained certificate is written to the path specified by `--kubeconfig`. The certificate and key file will be placed in the directory specified by `--cert-dir`.
+
+The flag to enable this bootstrapping when starting the kubelet is:

 ```
 --experimental-bootstrap-kubeconfig="/path/to/bootstrap/kubeconfig"
-``` 
+```

-## kubectl approval 
-The signing controller does not immediately sign all certificate requests. Instead, it waits until they have been flagged with an 
+## kubectl approval
+The signing controller does not immediately sign all certificate requests. Instead, it waits until they have been flagged with an
 "Approved" status by an appropriately-privileged user. This is intended to eventually be an automated process handled by an external
-approval controller, but for the alpha version of the API it can be done manually by a cluster administrator using kubectl. 
-An administrator can list CSRs with `kubectl get csr`, describe one in detail with `kubectl describe <name>`. There are 
-[currently no direct approve/deny commands](https://github.com/kubernetes/kubernetes/issues/30163) so an approver will need to update
-the Status field directly. A rough example of how to do this in bash which should only be used until the porcelain merges is available
-at [https://github.com/gtank/csrctl](https://github.com/gtank/csrctl).
-
+approval controller, but for the alpha version of the API it can be done manually by a cluster administrator using kubectl.
+An administrator can list CSRs with `kubectl get csr` and describe one in detail with `kubectl describe csr <name>`. Before the 1.6 release there were
+[no direct approve/deny commands](https://github.com/kubernetes/kubernetes/issues/30163) so an approver had to update
+the Status field directly ([rough how-to](https://github.com/gtank/csrctl)). Later versions of Kubernetes offer `kubectl certificate approve <name>` and `kubectl certificate deny <name>` commands.
@@ -1,5 +1,5 @@
 ---
-title: Overview
+title: kubelet
 notitle: true
 ---
 ## kubelet
@@ -25,8 +25,7 @@ seconds (configurable with a flag).
 HTTP endpoint: HTTP endpoint passed as a parameter on the command line. This endpoint
 is checked every 20 seconds (also configurable with a flag).

-HTTP server: The kubelet can also listen for HTTP and respond to a simple API
-(underspec'd currently) to submit a new manifest.
+HTTP server: The kubelet can also listen for HTTP requests and respond to a simple API call to submit a new manifest.

 ```
 kubelet
@@ -67,7 +66,7 @@ kubelet
      --enable-custom-metrics                                   Support for gathering custom metrics.
      --enable-debugging-handlers                               Enables server endpoints for log collection and local running of containers and commands (default true)
      --enable-server                                           Enable the Kubelet's server (default true)
-      --enforce-node-allocatable stringSlice                    A comma separated list of levels of node allocatable enforcement to be enforced by kubelet. Acceptible options are 'pods', 'system-reserved' & 'kube-reserved'. If the latter two options are specified, '--system-reserved-cgroup' & '--kube-reserved-cgroup' must also be set respectively. See https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node-allocatable.md for more details. [default='pods'] (default [pods])
+      --enforce-node-allocatable stringSlice                    A comma separated list of levels of node allocatable enforcement to be enforced by kubelet. Acceptible options are 'pods', 'system-reserved' & 'kube-reserved'. If the latter two options are specified, '--system-reserved-cgroup' & '--kube-reserved-cgroup' must also be set respectively. See https://git.k8s.io/community/contributors/design-proposals/node-allocatable.md for more details. [default='pods'] (default [pods])
      --event-burst int32                                       Maximum size of a bursty event records, temporarily allows event records to burst to this number, while still not exceeding event-qps. Only used if --event-qps > 0 (default 10)
      --event-qps int32                                         If > 0, limit event creations per second to this value. If 0, unlimited. (default 5)
      --eviction-hard string                                    A set of eviction thresholds (e.g. memory.available<1Gi) that if met would trigger a pod eviction. (default "memory.available<100Mi")
@@ -77,7 +76,7 @@ kubelet
      --eviction-soft string                                    A set of eviction thresholds (e.g. memory.available<1.5Gi) that if met over a corresponding grace period would trigger a pod eviction.
      --eviction-soft-grace-period string                       A set of eviction grace periods (e.g. memory.available=1m30s) that correspond to how long a soft eviction threshold must hold before triggering a pod eviction.
      --exit-on-lock-contention                                 Whether kubelet should exit upon lock-file contention.
-      --experimental-allocatable-ignore-eviction                When set to 'true', Hard Eviction Thresholds will be ignored while calculating Node Allocatable. See https://github.com/kubernetes/community/blob/master/contributors/design-proposals/node-allocatable.md for more details. [default=false]
+      --experimental-allocatable-ignore-eviction                When set to 'true', Hard Eviction Thresholds will be ignored while calculating Node Allocatable. See https://git.k8s.io/community/contributors/design-proposals/node-allocatable.md for more details. [default=false]
      --experimental-allowed-unsafe-sysctls stringSlice         Comma-separated whitelist of unsafe sysctls or unsafe sysctl patterns (ending in *). Use these at your own risk.
      --experimental-bootstrap-kubeconfig string                <Warning: Experimental feature> Path to a kubeconfig file that will be used to get client certificate for kubelet. If the file specified by --kubeconfig does not exist, the bootstrap kubeconfig is used to request a client certificate from the API server. On success, a kubeconfig file referencing the generated key and obtained certificate is written to the path specified by --kubeconfig. The certificate and key file will be stored in the directory pointed by --cert-dir.
      --experimental-check-node-capabilities-before-mount       [Experimental] if set true, the kubelet will check the underlying node for required componenets (binaries, etc.) before performing the mount
@@ -1,10 +0,0 @@
---
-assignees:
- derekwaynecarr
- janetkuo
-title: Setting Pod CPU and Memory Limits
---
-
-{% include user-guide-content-moved.md %}
-
-[Setting Pod CPU and Memory Limits](/docs/tasks/configure-pod-container/limit-range/)
@@ -1,9 +0,0 @@
---
-assignees:
- davidopp
-title: Using Multiple Clusters
---
-
-{% include user-guide-content-moved.md %}
-
-[Using Multiple Clusters](/docs/concepts/cluster-administration/multiple-clusters/)
@@ -11,7 +11,7 @@ title: Running in Multiple Zones
 Kubernetes 1.2 adds support for running a single cluster in multiple failure zones
 (GCE calls them simply "zones", AWS calls them "availability zones", here we'll refer to them as "zones").
 This is a lightweight version of a broader Cluster Federation feature (previously referred to by the affectionate
-nickname ["Ubernetes"](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/federation.md)).
+nickname ["Ubernetes"](https://git.k8s.io/community/contributors/design-proposals/federation.md)).
 Full Cluster Federation allows combining separate
 Kubernetes clusters running in different regions or cloud providers
 (or on-premise data centers).  However, many
@@ -111,11 +111,11 @@ and `failure-domain.beta.kubernetes.io/zone` for the zone:
 > kubectl get nodes --show-labels


-NAME                     STATUS                     AGE       LABELS
-kubernetes-master        Ready,SchedulingDisabled   6m        beta.kubernetes.io/instance-type=n1-standard-1,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-master
-kubernetes-minion-87j9   Ready                      6m        beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-87j9
-kubernetes-minion-9vlv   Ready                      6m        beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-9vlv
-kubernetes-minion-a12q   Ready                      6m        beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-a12q
+NAME                     STATUS                     AGE   VERSION          LABELS
+kubernetes-master        Ready,SchedulingDisabled   6m    v1.6.0+fff5156   beta.kubernetes.io/instance-type=n1-standard-1,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-master
+kubernetes-minion-87j9   Ready                      6m    v1.6.0+fff5156   beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-87j9
+kubernetes-minion-9vlv   Ready                      6m    v1.6.0+fff5156   beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-9vlv
+kubernetes-minion-a12q   Ready                      6m    v1.6.0+fff5156   beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-a12q
 ```

 ### Add more nodes in a second zone
@@ -146,14 +146,14 @@ in us-central1-b:
 ```shell
 > kubectl get nodes --show-labels

-NAME                     STATUS                     AGE       LABELS
-kubernetes-master        Ready,SchedulingDisabled   16m       beta.kubernetes.io/instance-type=n1-standard-1,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-master
-kubernetes-minion-281d   Ready                      2m        beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-b,kubernetes.io/hostname=kubernetes-minion-281d
-kubernetes-minion-87j9   Ready                      16m       beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-87j9
-kubernetes-minion-9vlv   Ready                      16m       beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-9vlv
-kubernetes-minion-a12q   Ready                      17m       beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-a12q
-kubernetes-minion-pp2f   Ready                      2m        beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-b,kubernetes.io/hostname=kubernetes-minion-pp2f
-kubernetes-minion-wf8i   Ready                      2m        beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-b,kubernetes.io/hostname=kubernetes-minion-wf8i
+NAME                     STATUS                     AGE   VERSION           LABELS
+kubernetes-master        Ready,SchedulingDisabled   16m   v1.6.0+fff5156    beta.kubernetes.io/instance-type=n1-standard-1,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-master
+kubernetes-minion-281d   Ready                      2m    v1.6.0+fff5156    beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-b,kubernetes.io/hostname=kubernetes-minion-281d
+kubernetes-minion-87j9   Ready                      16m   v1.6.0+fff5156    beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-87j9
+kubernetes-minion-9vlv   Ready                      16m   v1.6.0+fff5156    beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-9vlv
+kubernetes-minion-a12q   Ready                      17m   v1.6.0+fff5156    beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-a12q
+kubernetes-minion-pp2f   Ready                      2m    v1.6.0+fff5156    beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-b,kubernetes.io/hostname=kubernetes-minion-pp2f
+kubernetes-minion-wf8i   Ready                      2m    v1.6.0+fff5156    beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-b,kubernetes.io/hostname=kubernetes-minion-wf8i
 ```

 ### Volume affinity
@@ -231,8 +231,8 @@ cross-zone attachments are not generally permitted by cloud providers:
 > kubectl describe pod mypod | grep Node
 Node:        kubernetes-minion-9vlv/10.240.0.5
 > kubectl get node kubernetes-minion-9vlv --show-labels
-NAME                     STATUS    AGE       LABELS
-kubernetes-minion-9vlv   Ready     22m       beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-9vlv
+NAME                     STATUS    AGE    VERSION          LABELS
+kubernetes-minion-9vlv   Ready     22m    v1.6.0+fff5156   beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-9vlv
 ```

 ### Pods are spread across zones
@@ -273,10 +273,10 @@ Node:        kubernetes-minion-281d/10.240.0.8
 Node:        kubernetes-minion-olsh/10.240.0.11

 > kubectl get node kubernetes-minion-9vlv kubernetes-minion-281d kubernetes-minion-olsh --show-labels
-NAME                     STATUS    AGE       LABELS
-kubernetes-minion-9vlv   Ready     34m       beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-9vlv
-kubernetes-minion-281d   Ready     20m       beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-b,kubernetes.io/hostname=kubernetes-minion-281d
-kubernetes-minion-olsh   Ready     3m        beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-f,kubernetes.io/hostname=kubernetes-minion-olsh
+NAME                     STATUS    AGE    VERSION          LABELS
+kubernetes-minion-9vlv   Ready     34m    v1.6.0+fff5156   beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-a,kubernetes.io/hostname=kubernetes-minion-9vlv
+kubernetes-minion-281d   Ready     20m    v1.6.0+fff5156   beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-b,kubernetes.io/hostname=kubernetes-minion-281d
+kubernetes-minion-olsh   Ready     3m     v1.6.0+fff5156   beta.kubernetes.io/instance-type=n1-standard-2,failure-domain.beta.kubernetes.io/region=us-central1,failure-domain.beta.kubernetes.io/zone=us-central1-f,kubernetes.io/hostname=kubernetes-minion-olsh
 ```


@@ -1,11 +0,0 @@
---
-assignees:
- dcbw
- freehan
- thockin
-title: Network Plugins
---
-
-{% include user-guide-content-moved.md %}
-
-[Network Plugins](/docs/concepts/cluster-administration/network-plugins/)
@@ -1,9 +0,0 @@
---
-assignees:
- thockin
-title: Networking in Kubernetes
---
-
-{% include user-guide-content-moved.md %}
-
-[Cluster Networking](/docs/concepts/cluster-administration/networking/)
@@ -84,7 +84,7 @@ sudo docker run -it --rm --privileged --net=host \
  gcr.io/google_containers/node-test:0.2
 ```

-Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/kubernetes/blob/{{page.version}}/docs/devel/e2e-node-tests.md).
+Node conformance test is a containerized version of [node e2e test](https://git.k8s.io/community/contributors/devel/e2e-node-tests.md).
 By default, it runs all conformance tests.

 Theoretically, you can run any node e2e test if you configure the container and
@@ -1,10 +0,0 @@
---
-assignees:
- Random-Liu
- dchen1107
-title: Monitoring Node Health
---
-
-{% include user-guide-content-moved.md %}
-
-[Monitoring Node Health](/docs/tasks/debug-application-cluster/monitor-node-health/)
@@ -1,11 +0,0 @@
---
-assignees:
- derekwaynecarr
- vishh
- timstclair
-title: Configuring Out Of Resource Handling
---
-
-{% include user-guide-content-moved.md %}
-
-[Configuring Out of Resource Handling](/docs/concepts/cluster-administration/out-of-resource/)
@@ -1,11 +0,0 @@
---
-assignees:
- davidopp
- filipg
- piosz
-title: Guaranteed Scheduling For Critical Add-On Pods
---
-
-{% include user-guide-content-moved.md %}
-
-[Guaranteed Scheduling for Critical Add-On Pods](/docs/concepts/cluster-administration/guaranteed-scheduling-critical-addon-pods/)
@@ -1,9 +0,0 @@
---
-assignees:
- derekwaynecarr
-title: Resource Quotas
---
-
-{% include user-guide-content-moved.md %}
-
-[Resource Quotas](/docs/concepts/policy/resource-quotas/)
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`*NOTE: This feature is beta in Kubernetes 1.5.*`