Update release-1.5 for version changes in 1.9 (#6522 )

* Update release-1.5 for version changes in 1.9 🛑 DO NOT MERGE 🛑 Update config files to use 1.9 as version number. * Update _config.yml
Update URL for 1.7 docs.
2017-12-15 17:41:03 -06:00 · 2017-10-10 12:41:17 -07:00 · 2017-10-09 21:55:30 -07:00 · 2017-09-01 17:08:10 -07:00 · 2017-09-01 17:04:59 -07:00 · 2017-08-10 22:41:51 -07:00
3161 changed files with 549518 additions and 32206 deletions
@@ -0,0 +1,3 @@
+> NOTE: Please check the “Allow edits from maintainers” box below to allow 
+> reviewers fix problems on your patch and speed up the review process.
+> Please delete this note before submitting the pull request.
@@ -5,3 +5,23 @@ _site/**
 .sass-cache/**
 CNAME
 .travis.yml
+.idea/
+
+# Vim ignore
+# source: https://github.com/github/gitignore/blob/master/Global/Vim.gitignore
+
+# swap
+[._]*.s[a-v][a-z]
+[._]*.sw[a-p]
+[._]s[a-v][a-z]
+[._]sw[a-p]
+# session
+Session.vim
+# temporary
+.netrwhist
+*~
+# auto-generated tag files
+tags
+
+kubernetes.github.io.iml
+_redirects
@@ -1,16 +1,29 @@
 language: go
 go:
-  - 1.6.2
+  - 1.8.1

 # Don't want default ./... here:
 install:
 - export PATH=$GOPATH/bin:$PATH
 - mkdir -p $HOME/gopath/src/k8s.io
 - mv $TRAVIS_BUILD_DIR $HOME/gopath/src/k8s.io/kubernetes.github.io
+
+# (1) Fetch dependencies for us to run the tests in test/examples_test.go
 - go get -t -v k8s.io/kubernetes.github.io/test
+
+# Simplified deduplication of dependencies.
+- cp -L -R $GOPATH/src/k8s.io/kubernetes/vendor/ $GOPATH/src/
+- rm -r $GOPATH/src/k8s.io/kubernetes/vendor/
+
+# (2) Fetch md-check along with all its dependencies.
 - git clone --depth=50 --branch=master https://github.com/kubernetes/md-check $HOME/gopath/src/k8s.io/md-check
 - go get -t -v k8s.io/md-check

+# (3) Fetch mungedocs
+- go get -v k8s.io/kubernetes/cmd/mungedocs
+
 script:
 - go test -v k8s.io/kubernetes.github.io/test
 - $GOPATH/bin/md-check --root-dir=$HOME/gopath/src/k8s.io/kubernetes.github.io
+- ./verify-docs-format.sh
+- $GOPATH/bin/mungedocs --verbose --verify --upstream=origin --root-dir=$HOME/gopath/src/k8s.io/kubernetes.github.io/docs/ --repo-root=$HOME/gopath/src/k8s.io/kubernetes.github.io --skip-munges=remove-whitespace,blank-lines-surround-preformatted,header-lines,sync-examples,analytics,analytics,kubectl-dash-f,table-of-contents,md-links,kubectl-dash-f
@@ -2,67 +2,10 @@
 layout: docwithnav
 title: 404 Error!
 permalink: /404.html
+no_canonical: true
+sitemap: false
 ---
-<script language="JavaScript">
-$( document ).ready(function() {
-  var oldURLs=["/README.md","/README.html",".html",".md","/v1.1/","/v1.0/"];
-  var fwdDirs=["examples/","cluster/","docs/devel","docs/design"];
-  var doRedirect = false;
-  var notHere = false;
-  var forwardingURL=window.location.href;
-  if (forwardingURL.indexOf("third_party/swagger-ui") > -1)
-  {
-    notHere = true;
-    window.location.replace("http://kubernetes.io/kubernetes/third_party/swagger-ui/");
-  }
-  if (forwardingURL.indexOf("resource-quota") > -1)
-  {
-    notHere = true;
-    window.location.replace("http://kubernetes.io/docs/admin/resourcequota/");
-  }
-  if (forwardingURL.indexOf("horizontal-pod-autoscaler") > -1)
-  {
-    notHere = true;
-    window.location.replace("http://kubernetes.io/docs/user-guide/horizontal-pod-autoscaling/");
-  } 
-  if (forwardingURL.indexOf("docs/roadmap") > -1)
-  {
-    notHere = true;
-    window.location.replace("https://github.com/kubernetes/kubernetes/milestones/");
-  }
-  if (forwardingURL.indexOf("api-ref/") > -1) 
-  {
-    notHere = true;
-    window.location.replace("http://kubernetes.io/docs/api/");
-  }
-  if (forwardingURL.indexOf("docs/user-guide/overview") > -1)
-  {
-    notHere = true;
-    window.location.replace("http://kubernetes.io/docs/whatisk8s/");
-  }
-  for (i=0;i<fwdDirs.length;i++) {
-    if (forwardingURL.indexOf(fwdDirs[i]) > -1)
-    {
-      var urlPieces = forwardingURL.split(fwdDirs[i]);
-      var newURL = "https://github.com/kubernetes/kubernetes/tree/{{page.githubbranch}}/" + fwdDirs[i] + urlPieces[1];
-      notHere = true;
-      window.location.replace(newURL);
-    }
-  }
-  if (!notHere) {
-    for (i=0;i<oldURLs.length;i++) {
-      if (forwardingURL.indexOf(oldURLs[i]) > -1)
-      {
-        doRedirect=true;
-        forwardingURL=forwardingURL.replace(oldURLs[i],"/");
-      }
-    }
-    if (doRedirect)
-    {
-      window.location.replace(forwardingURL);
-    };
-  }
-});
-</script>
+
+<script src="/js/redirects.js"></script>

 Sorry, this page was not found. :(
@@ -1,2 +1 @@
-kubernetes.io
-kubernet.es
+kubernetes.io
@@ -0,0 +1,36 @@
+# Contributing to Kubernetes Documentation
+
+**First off, thanks for taking the time to contribute!**
+
+The following is a set of guidelines for contributing to Kubernetes documentation, hosted at [Kubernetes.io](http://kubernetes.io/).
+These are just guidelines, not rules. Use your best judgment, and feel free to propose changes to this document in a pull request.
+
+## Before you get started
+
+### Code of Conduct
+
+Kubernetes follows the [Cloud Native Computing Foundation (CNCF) Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). By participating, you are expected to uphold this code. Please report unacceptable behavior to Sarah Novotny [sarahnovotny@google.com](mailto:sarahnovotny@google.com) and/or Dan Kohn [dan@linuxfoundation.org](mailto:dan@linuxfoundation.org). 
+
+### Documentation and Site Decisions
+
+The [Kubernetes SIG Docs Discussion Group](https://groups.google.com/forum/#!forum/kubernetes-sig-docs) is the discussion group for doc releases, suggested site improvements, and improving the doc contribution experience. If you are planning to be a regular contributor, join this group to stay informed and involved.
+
+### Style Guides and Templates
+
+Before submitting a pull request to create new content, please review the [Kubernetes.io style guide](http://kubernetes.io/docs/contribute/style-guide/) and follow the [instructions for using page templates](http://kubernetes.io/docs/contribute/page-templates/). 
+
+
+## Contributing to Documentation
+
+### Reporting Documentation Issues
+
+Kubernetes.io uses github issues to track documentation issues and requests. If you see a documentation issue, submit an issue using the following steps:
+
+1. Check the [kubernetes.io issues list](https://github.com/kubernetes/kubernetes.github.io/issues) as you might find out the issue is a duplicate. 
+2. Use the [included template for every new issue](https://github.com/kubernetes/kubernetes.github.io/issues/new).  When you create a bug report, include as many details as possible and include suggested fixes to the issue. 
+
+Note that code issues should be filed against the main kubernetes repository, while documentation issues should go in the kubernetes.io repository. 
+
+### Submitting Documentation Pull Requests
+
+If you're fixing an issue in the existing documentation, you should submit a PR against the master branch.  Follow [these instructions to create a documentation pull request against the kubernetes.io repository](http://kubernetes.io/docs/contribute/create-pull-request/).
@@ -1,20 +1,4 @@
 source "https://rubygems.org"

-gem "jekyll", "3.2.1"
-gem "jekyll-sass-converter", "1.3.0"
-gem "minima", "1.1.0"
-gem "kramdown", "1.11.1"
-gem "liquid", "3.0.6"
-gem "rouge", "1.11.1"
-gem "jemoji", "0.7.0"
-gem "jekyll-mentions", "1.2.0"
-gem "jekyll-redirect-from", "0.11.0"
-gem "jekyll-sitemap", "0.10.0"
-gem "jekyll-feed", "0.5.1"
-gem "jekyll-gist", "1.4.0"
-gem "jekyll-paginate", "1.1.0"
-gem "jekyll-coffeescript", "1.0.1"
-gem "jekyll-seo-tag", "2.0.0"
-gem "jekyll-github-metadata", "2.0.2"
-gem "listen", "3.0.6"
-gem "activesupport", "4.2.7"
+gem "github-pages", group: :jekyll_plugins
+gem "jekyll-include-cache", "~> 0.1"
@@ -7,23 +7,75 @@ GEM
      minitest (~> 5.1)
      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    addressable (2.4.0)
+    addressable (2.5.0)
+      public_suffix (~> 2.0, >= 2.0.2)
    coffee-script (2.4.1)
      coffee-script-source
      execjs
-    coffee-script-source (1.10.0)
+    coffee-script-source (1.12.2)
    colorator (1.1.0)
+    ethon (0.10.1)
+      ffi (>= 1.3.0)
    execjs (2.7.0)
-    faraday (0.9.2)
+    faraday (0.10.0)
      multipart-post (>= 1.2, < 3)
    ffi (1.9.14)
    forwardable-extended (2.6.0)
    gemoji (2.1.0)
+    github-pages (112)
+      activesupport (= 4.2.7)
+      github-pages-health-check (= 1.3.0)
+      jekyll (= 3.3.1)
+      jekyll-avatar (= 0.4.2)
+      jekyll-coffeescript (= 1.0.1)
+      jekyll-default-layout (= 0.1.4)
+      jekyll-feed (= 0.8.0)
+      jekyll-gist (= 1.4.0)
+      jekyll-github-metadata (= 2.2.0)
+      jekyll-mentions (= 1.2.0)
+      jekyll-optional-front-matter (= 0.1.2)
+      jekyll-paginate (= 1.1.0)
+      jekyll-readme-index (= 0.0.3)
+      jekyll-redirect-from (= 0.11.0)
+      jekyll-relative-links (= 0.2.1)
+      jekyll-sass-converter (= 1.3.0)
+      jekyll-seo-tag (= 2.1.0)
+      jekyll-sitemap (= 0.12.0)
+      jekyll-swiss (= 0.4.0)
+      jekyll-theme-architect (= 0.0.3)
+      jekyll-theme-cayman (= 0.0.3)
+      jekyll-theme-dinky (= 0.0.3)
+      jekyll-theme-hacker (= 0.0.3)
+      jekyll-theme-leap-day (= 0.0.3)
+      jekyll-theme-merlot (= 0.0.3)
+      jekyll-theme-midnight (= 0.0.3)
+      jekyll-theme-minimal (= 0.0.3)
+      jekyll-theme-modernist (= 0.0.3)
+      jekyll-theme-primer (= 0.1.5)
+      jekyll-theme-slate (= 0.0.3)
+      jekyll-theme-tactile (= 0.0.3)
+      jekyll-theme-time-machine (= 0.0.3)
+      jekyll-titles-from-headings (= 0.1.3)
+      jemoji (= 0.7.0)
+      kramdown (= 1.11.1)
+      liquid (= 3.0.6)
+      listen (= 3.0.6)
+      mercenary (~> 0.3)
+      minima (= 2.0.0)
+      rouge (= 1.11.1)
+      terminal-table (~> 1.4)
+    github-pages-health-check (1.3.0)
+      addressable (~> 2.3)
+      net-dns (~> 0.8)
+      octokit (~> 4.0)
+      public_suffix (~> 2.0)
+      typhoeus (~> 0.7)
    html-pipeline (2.4.2)
      activesupport (>= 2)
      nokogiri (>= 1.4)
    i18n (0.7.0)
-    jekyll (3.2.1)
+    jekyll (3.3.1)
+      addressable (~> 2.4)
      colorator (~> 1.0)
      jekyll-sass-converter (~> 1.0)
      jekyll-watch (~> 1.1)
@@ -33,26 +85,69 @@ GEM
      pathutil (~> 0.9)
      rouge (~> 1.7)
      safe_yaml (~> 1.0)
+    jekyll-avatar (0.4.2)
+      jekyll (~> 3.0)
    jekyll-coffeescript (1.0.1)
      coffee-script (~> 2.2)
-    jekyll-feed (0.5.1)
+    jekyll-default-layout (0.1.4)
+      jekyll (~> 3.0)
+    jekyll-feed (0.8.0)
+      jekyll (~> 3.3)
    jekyll-gist (1.4.0)
      octokit (~> 4.2)
-    jekyll-github-metadata (2.0.2)
+    jekyll-github-metadata (2.2.0)
      jekyll (~> 3.1)
-      octokit (~> 4.0)
+      octokit (~> 4.0, != 4.4.0)
+    jekyll-include-cache (0.1.0)
+      jekyll (~> 3.3)
    jekyll-mentions (1.2.0)
      activesupport (~> 4.0)
      html-pipeline (~> 2.3)
      jekyll (~> 3.0)
+    jekyll-optional-front-matter (0.1.2)
+      jekyll (~> 3.0)
    jekyll-paginate (1.1.0)
+    jekyll-readme-index (0.0.3)
+      jekyll (~> 3.0)
    jekyll-redirect-from (0.11.0)
      jekyll (>= 2.0)
+    jekyll-relative-links (0.2.1)
+      jekyll (~> 3.3)
    jekyll-sass-converter (1.3.0)
      sass (~> 3.2)
-    jekyll-seo-tag (2.0.0)
-      jekyll (~> 3.1)
-    jekyll-sitemap (0.10.0)
+    jekyll-seo-tag (2.1.0)
+      jekyll (~> 3.3)
+    jekyll-sitemap (0.12.0)
+      jekyll (~> 3.3)
+    jekyll-swiss (0.4.0)
+    jekyll-theme-architect (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-cayman (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-dinky (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-hacker (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-leap-day (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-merlot (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-midnight (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-minimal (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-modernist (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-primer (0.1.5)
+      jekyll (~> 3.3)
+    jekyll-theme-slate (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-tactile (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-theme-time-machine (0.0.3)
+      jekyll (~> 3.3)
+    jekyll-titles-from-headings (0.1.3)
+      jekyll (~> 3.3)
    jekyll-watch (1.5.0)
      listen (~> 3.0, < 3.1)
    jemoji (0.7.0)
@@ -68,52 +163,41 @@ GEM
      rb-inotify (>= 0.9.7)
    mercenary (0.3.6)
    mini_portile2 (2.1.0)
-    minima (1.1.0)
-    minitest (5.9.0)
+    minima (2.0.0)
+    minitest (5.10.1)
    multipart-post (2.0.0)
-    nokogiri (1.6.8)
+    net-dns (0.8.0)
+    nokogiri (1.6.8.1)
      mini_portile2 (~> 2.1.0)
-      pkg-config (~> 1.1.7)
-    octokit (4.3.0)
-      sawyer (~> 0.7.0, >= 0.5.3)
+    octokit (4.6.2)
+      sawyer (~> 0.8.0, >= 0.5.3)
    pathutil (0.14.0)
      forwardable-extended (~> 2.6)
-    pkg-config (1.1.7)
-    rb-fsevent (0.9.7)
+    public_suffix (2.0.4)
+    rb-fsevent (0.9.8)
    rb-inotify (0.9.7)
      ffi (>= 0.5.0)
    rouge (1.11.1)
    safe_yaml (1.0.4)
-    sass (3.4.22)
-    sawyer (0.7.0)
-      addressable (>= 2.3.5, < 2.5)
-      faraday (~> 0.8, < 0.10)
+    sass (3.4.23)
+    sawyer (0.8.1)
+      addressable (>= 2.3.5, < 2.6)
+      faraday (~> 0.8, < 1.0)
+    terminal-table (1.7.3)
+      unicode-display_width (~> 1.1.1)
    thread_safe (0.3.5)
+    typhoeus (0.8.0)
+      ethon (>= 0.8.0)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
+    unicode-display_width (1.1.2)

 PLATFORMS
  ruby

 DEPENDENCIES
-  activesupport (= 4.2.7)
-  jekyll (= 3.2.1)
-  jekyll-coffeescript (= 1.0.1)
-  jekyll-feed (= 0.5.1)
-  jekyll-gist (= 1.4.0)
-  jekyll-github-metadata (= 2.0.2)
-  jekyll-mentions (= 1.2.0)
-  jekyll-paginate (= 1.1.0)
-  jekyll-redirect-from (= 0.11.0)
-  jekyll-sass-converter (= 1.3.0)
-  jekyll-seo-tag (= 2.0.0)
-  jekyll-sitemap (= 0.10.0)
-  jemoji (= 0.7.0)
-  kramdown (= 1.11.1)
-  liquid (= 3.0.6)
-  listen (= 3.0.6)
-  minima (= 1.1.0)
-  rouge (= 1.11.1)
+  github-pages
+  jekyll-include-cache (~> 0.1)

 BUNDLED WITH
-   1.11.2
+   1.13.6
@@ -1,201 +1,395 @@
-Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+Attribution 4.0 International

-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+=======================================================================

-   1. Definitions.
+Creative Commons Corporation ("Creative Commons") is not a law firm and
+does not provide legal services or legal advice. Distribution of
+Creative Commons public licenses does not create a lawyer-client or
+other relationship. Creative Commons makes its licenses and related
+information available on an "as-is" basis. Creative Commons gives no
+warranties regarding its licenses, any material licensed under their
+terms and conditions, or any related information. Creative Commons
+disclaims all liability for damages resulting from their use to the
+fullest extent possible.

-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
+Using Creative Commons Public Licenses

-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
+Creative Commons public licenses provide a standard set of terms and
+conditions that creators and other rights holders may use to share
+original works of authorship and other material subject to copyright
+and certain other rights specified in the public license below. The
+following considerations are for informational purposes only, are not
+exhaustive, and do not form part of our licenses.

-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
+     Considerations for licensors: Our public licenses are
+     intended for use by those authorized to give the public
+     permission to use material in ways otherwise restricted by
+     copyright and certain other rights. Our licenses are
+     irrevocable. Licensors should read and understand the terms
+     and conditions of the license they choose before applying it.
+     Licensors should also secure all rights necessary before
+     applying our licenses so that the public can reuse the
+     material as expected. Licensors should clearly mark any
+     material not subject to the license. This includes other CC-
+     licensed material, or material used under an exception or
+     limitation to copyright. More considerations for licensors:
+	wiki.creativecommons.org/Considerations_for_licensors

-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
+     Considerations for the public: By using one of our public
+     licenses, a licensor grants the public permission to use the
+     licensed material under specified terms and conditions. If
+     the licensor's permission is not necessary for any reason--for
+     example, because of any applicable exception or limitation to
+     copyright--then that use is not regulated by the license. Our
+     licenses grant only permissions under copyright and certain
+     other rights that a licensor has authority to grant. Use of
+     the licensed material may still be restricted for other
+     reasons, including because others have copyright or other
+     rights in the material. A licensor may make special requests,
+     such as asking that all changes be marked or described.
+     Although not required by our licenses, you are encouraged to
+     respect those requests where reasonable. More_considerations
+     for the public: 
+	wiki.creativecommons.org/Considerations_for_licensees

-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
+=======================================================================

-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
+Creative Commons Attribution 4.0 International Public License

-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
+By exercising the Licensed Rights (defined below), You accept and agree
+to be bound by the terms and conditions of this Creative Commons
+Attribution 4.0 International Public License ("Public License"). To the
+extent this Public License may be interpreted as a contract, You are
+granted the Licensed Rights in consideration of Your acceptance of
+these terms and conditions, and the Licensor grants You such rights in
+consideration of benefits the Licensor receives from making the
+Licensed Material available under these terms and conditions.

-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.

-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
+Section 1 -- Definitions.

-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
+  a. Adapted Material means material subject to Copyright and Similar
+     Rights that is derived from or based upon the Licensed Material
+     and in which the Licensed Material is translated, altered,
+     arranged, transformed, or otherwise modified in a manner requiring
+     permission under the Copyright and Similar Rights held by the
+     Licensor. For purposes of this Public License, where the Licensed
+     Material is a musical work, performance, or sound recording,
+     Adapted Material is always produced where the Licensed Material is
+     synched in timed relation with a moving image.

-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
+  b. Adapter's License means the license You apply to Your Copyright
+     and Similar Rights in Your contributions to Adapted Material in
+     accordance with the terms and conditions of this Public License.

-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
+  c. Copyright and Similar Rights means copyright and/or similar rights
+     closely related to copyright including, without limitation,
+     performance, broadcast, sound recording, and Sui Generis Database
+     Rights, without regard to how the rights are labeled or
+     categorized. For purposes of this Public License, the rights
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
+     Rights.

-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
+  d. Effective Technological Measures means those measures that, in the
+     absence of proper authority, may not be circumvented under laws
+     fulfilling obligations under Article 11 of the WIPO Copyright
+     Treaty adopted on December 20, 1996, and/or similar international
+     agreements.

-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
+  e. Exceptions and Limitations means fair use, fair dealing, and/or
+     any other exception or limitation to Copyright and Similar Rights
+     that applies to Your use of the Licensed Material.

-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
+  f. Licensed Material means the artistic or literary work, database,
+     or other material to which the Licensor applied this Public
+     License.

-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
+  g. Licensed Rights means the rights granted to You subject to the
+     terms and conditions of this Public License, which are limited to
+     all Copyright and Similar Rights that apply to Your use of the
+     Licensed Material and that the Licensor has authority to license.

-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
+  h. Licensor means the individual(s) or entity(ies) granting rights
+     under this Public License.

-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
+  i. Share means to provide material to the public by any means or
+     process that requires permission under the Licensed Rights, such
+     as reproduction, public display, public performance, distribution,
+     dissemination, communication, or importation, and to make material
+     available to the public including in ways that members of the
+     public may access the material from a place and at a time
+     individually chosen by them.

-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
+  j. Sui Generis Database Rights means rights other than copyright
+     resulting from Directive 96/9/EC of the European Parliament and of
+     the Council of 11 March 1996 on the legal protection of databases,
+     as amended and/or succeeded, as well as other essentially
+     equivalent rights anywhere in the world.

-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
+  k. You means the individual or entity exercising the Licensed Rights
+     under this Public License. Your has a corresponding meaning.

-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.

-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
+Section 2 -- Scope.

-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
+  a. License grant.

-   END OF TERMS AND CONDITIONS
+       1. Subject to the terms and conditions of this Public License,
+          the Licensor hereby grants You a worldwide, royalty-free,
+          non-sublicensable, non-exclusive, irrevocable license to
+          exercise the Licensed Rights in the Licensed Material to:

-   APPENDIX: How to apply the Apache License to your work.
+            a. reproduce and Share the Licensed Material, in whole or
+               in part; and

-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
+            b. produce, reproduce, and Share Adapted Material.

-   Copyright 2016 The Kubernetes Authors
+       2. Exceptions and Limitations. For the avoidance of doubt, where
+          Exceptions and Limitations apply to Your use, this Public
+          License does not apply, and You do not need to comply with
+          its terms and conditions.

-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
+       3. Term. The term of this Public License is specified in Section
+          6(a).

-       http://www.apache.org/licenses/LICENSE-2.0
+       4. Media and formats; technical modifications allowed. The
+          Licensor authorizes You to exercise the Licensed Rights in
+          all media and formats whether now known or hereafter created,
+          and to make technical modifications necessary to do so. The
+          Licensor waives and/or agrees not to assert any right or
+          authority to forbid You from making technical modifications
+          necessary to exercise the Licensed Rights, including
+          technical modifications necessary to circumvent Effective
+          Technological Measures. For purposes of this Public License,
+          simply making modifications authorized by this Section 2(a)
+          (4) never produces Adapted Material.

-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+       5. Downstream recipients.
+
+            a. Offer from the Licensor -- Licensed Material. Every
+               recipient of the Licensed Material automatically
+               receives an offer from the Licensor to exercise the
+               Licensed Rights under the terms and conditions of this
+               Public License.
+
+            b. No downstream restrictions. You may not offer or impose
+               any additional or different terms or conditions on, or
+               apply any Effective Technological Measures to, the
+               Licensed Material if doing so restricts exercise of the
+               Licensed Rights by any recipient of the Licensed
+               Material.
+
+       6. No endorsement. Nothing in this Public License constitutes or
+          may be construed as permission to assert or imply that You
+          are, or that Your use of the Licensed Material is, connected
+          with, or sponsored, endorsed, or granted official status by,
+          the Licensor or others designated to receive attribution as
+          provided in Section 3(a)(1)(A)(i).
+
+  b. Other rights.
+
+       1. Moral rights, such as the right of integrity, are not
+          licensed under this Public License, nor are publicity,
+          privacy, and/or other similar personality rights; however, to
+          the extent possible, the Licensor waives and/or agrees not to
+          assert any such rights held by the Licensor to the limited
+          extent necessary to allow You to exercise the Licensed
+          Rights, but not otherwise.
+
+       2. Patent and trademark rights are not licensed under this
+          Public License.
+
+       3. To the extent possible, the Licensor waives any right to
+          collect royalties from You for the exercise of the Licensed
+          Rights, whether directly or through a collecting society
+          under any voluntary or waivable statutory or compulsory
+          licensing scheme. In all other cases the Licensor expressly
+          reserves any right to collect such royalties.
+
+
+Section 3 -- License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the
+following conditions.
+
+  a. Attribution.
+
+       1. If You Share the Licensed Material (including in modified
+          form), You must:
+
+            a. retain the following if it is supplied by the Licensor
+               with the Licensed Material:
+
+                 i. identification of the creator(s) of the Licensed
+                    Material and any others designated to receive
+                    attribution, in any reasonable manner requested by
+                    the Licensor (including by pseudonym if
+                    designated);
+
+                ii. a copyright notice;
+
+               iii. a notice that refers to this Public License;
+
+                iv. a notice that refers to the disclaimer of
+                    warranties;
+
+                 v. a URI or hyperlink to the Licensed Material to the
+                    extent reasonably practicable;
+
+            b. indicate if You modified the Licensed Material and
+               retain an indication of any previous modifications; and
+
+            c. indicate the Licensed Material is licensed under this
+               Public License, and include the text of, or the URI or
+               hyperlink to, this Public License.
+
+       2. You may satisfy the conditions in Section 3(a)(1) in any
+          reasonable manner based on the medium, means, and context in
+          which You Share the Licensed Material. For example, it may be
+          reasonable to satisfy the conditions by providing a URI or
+          hyperlink to a resource that includes the required
+          information.
+
+       3. If requested by the Licensor, You must remove any of the
+          information required by Section 3(a)(1)(A) to the extent
+          reasonably practicable.
+
+       4. If You Share Adapted Material You produce, the Adapter's
+          License You apply must not prevent recipients of the Adapted
+          Material from complying with this Public License.
+
+
+Section 4 -- Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that
+apply to Your use of the Licensed Material:
+
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
+     to extract, reuse, reproduce, and Share all or a substantial
+     portion of the contents of the database;
+
+  b. if You include all or a substantial portion of the database
+     contents in a database in which You have Sui Generis Database
+     Rights, then the database in which You have Sui Generis Database
+     Rights (but not its individual contents) is Adapted Material; and
+
+  c. You must comply with the conditions in Section 3(a) if You Share
+     all or a substantial portion of the contents of the database.
+
+For the avoidance of doubt, this Section 4 supplements and does not
+replace Your obligations under this Public License where the Licensed
+Rights include other Copyright and Similar Rights.
+
+
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
+
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
+
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
+
+  c. The disclaimer of warranties and limitation of liability provided
+     above shall be interpreted in a manner that, to the extent
+     possible, most closely approximates an absolute disclaimer and
+     waiver of all liability.
+
+
+Section 6 -- Term and Termination.
+
+  a. This Public License applies for the term of the Copyright and
+     Similar Rights licensed here. However, if You fail to comply with
+     this Public License, then Your rights under this Public License
+     terminate automatically.
+
+  b. Where Your right to use the Licensed Material has terminated under
+     Section 6(a), it reinstates:
+
+       1. automatically as of the date the violation is cured, provided
+          it is cured within 30 days of Your discovery of the
+          violation; or
+
+       2. upon express reinstatement by the Licensor.
+
+     For the avoidance of doubt, this Section 6(b) does not affect any
+     right the Licensor may have to seek remedies for Your violations
+     of this Public License.
+
+  c. For the avoidance of doubt, the Licensor may also offer the
+     Licensed Material under separate terms or conditions or stop
+     distributing the Licensed Material at any time; however, doing so
+     will not terminate this Public License.
+
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
+     License.
+
+
+Section 7 -- Other Terms and Conditions.
+
+  a. The Licensor shall not be bound by any additional or different
+     terms or conditions communicated by You unless expressly agreed.
+
+  b. Any arrangements, understandings, or agreements regarding the
+     Licensed Material not stated herein are separate from and
+     independent of the terms and conditions of this Public License.
+
+
+Section 8 -- Interpretation.
+
+  a. For the avoidance of doubt, this Public License does not, and
+     shall not be interpreted to, reduce, limit, restrict, or impose
+     conditions on any use of the Licensed Material that could lawfully
+     be made without permission under this Public License.
+
+  b. To the extent possible, if any provision of this Public License is
+     deemed unenforceable, it shall be automatically reformed to the
+     minimum extent necessary to make it enforceable. If the provision
+     cannot be reformed, it shall be severed from this Public License
+     without affecting the enforceability of the remaining terms and
+     conditions.
+
+  c. No term or condition of this Public License will be waived and no
+     failure to comply consented to unless expressly agreed to by the
+     Licensor.
+
+  d. Nothing in this Public License constitutes or may be interpreted
+     as a limitation upon, or waiver of, any privileges and immunities
+     that apply to the Licensor or You, including from the legal
+     processes of any jurisdiction or authority.
+
+
+=======================================================================
+
+Creative Commons is not a party to its public
+licenses. Notwithstanding, Creative Commons may elect to apply one of
+its public licenses to material it publishes and in those instances
+will be considered the "Licensor." The text of the Creative Commons
+public licenses is dedicated to the public domain under the CC0 Public
+Domain Dedication. Except for the limited purpose of indicating that
+material is shared under a Creative Commons public license or as
+otherwise permitted by the Creative Commons policies published at
+creativecommons.org/policies, Creative Commons does not authorize the
+use of the trademark "Creative Commons" or any other trademark or logo
+of Creative Commons without its prior written consent including,
+without limitation, in connection with any unauthorized modifications
+to any of its public licenses or any other arrangements,
+understandings, or agreements concerning use of licensed material. For
+the avoidance of doubt, this paragraph does not form part of the
+public licenses.
+
+Creative Commons may be contacted at creativecommons.org.
@@ -1,4 +1,4 @@
-.PONY: all build build-preview help serve
+.PHONY: all build build-preview generate-redirects help serve

 help: ## Show this help.
 	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
@@ -11,5 +11,8 @@ build: ## Build site with production settings and put deliverables in _site.
 build-preview: ## Build site with drafts and future posts enabled.
 	jekyll build --drafts --future

+generate-redirects: ## Generate a redirects file and copy it into the _site directory.
+	mkdir -p _site && REDIRECTS_PATH=_site/_redirects ruby redirects.rb
+
 serve: ## Boot the development server.
 	jekyll serve
@@ -1,5 +1,4 @@
 assignees:
- lavalamp
 - smarterclayton
 - janetkuo
 - pwittrock
@@ -1,194 +1,19 @@
-## Instructions for Contributing to the Docs/Website
+## Instructions for Contributing to the Kubernetes Documentation

-Welcome! We are very pleased you want to contribute to the documentation and/or website for Kubernetes.
+Welcome! We are very pleased you want to contribute to the Kubernetes documentation.

-You can click the "Fork" button in the upper-right area of the screen to create a copy of our site on your GitHub account called a "fork." Make any changes you want in your fork, and when you are ready to send those changes to us, go to the index page for your fork and click "New Pull Request" to let us know about it.
+You can click the **Fork** button in the upper-right area of the screen to create a copy of this repository in your GitHub account called a *fork*. Make any changes you want in your fork, and when you are ready to send those changes to us, go to your fork and create a new pull request to let us know about it.

-## Staging the site on GitHub Pages
+For more information about contributing to the Kubernetes documentation, see:

-If you want to see your changes staged without having to install anything locally, remove the CNAME file in this directory and
-change the name of the fork to be:
-
-    YOUR_GITHUB_USERNAME.github.io
-
-Then make your changes.
-
-When you visit [http://YOUR_GITHUB_USERNAME.github.io](http://YOUR_GITHUB_USERNAME.github.io) you should see a special-to-you version of the site that contains the changes you just made.
-
-## Staging the site locally (using Docker)
-
-Don't like installing stuff? Download and run a local staging server with a single `docker run` command. 
-
-    git clone https://github.com/kubernetes/kubernetes.github.io.git
-    cd kubernetes.github.io
-    docker run -ti --rm -v "$PWD":/k8sdocs -p 4000:4000 gcr.io/google-samples/k8sdocs:1.0
-
-Then visit [http://localhost:4000](http://localhost:4000) to see our site. Any changes you make on your local machine will be automatically staged.
-
-If you're interested you can view [the Dockerfile for this image](https://github.com/kubernetes/kubernetes.github.io/blob/master/staging-container/Dockerfile).
-
-## Staging the site locally (from scratch setup)
-
-The below commands to setup your environment for running GitHub pages locally. Then, any edits you make will be viewable
-on a lightweight webserver that runs on your local machine.
-
-This will typically be the fastest way (by far) to iterate on docs changes and see them staged, once you get this set up, but it does involve several install steps that take awhile to complete, and makes system-wide modifications.
-
-Install Ruby 2.2 or higher. If you're on Linux, run these commands:
-
-    apt-get install software-properties-common
-    apt-add-repository ppa:brightbox/ruby-ng
-    apt-get install ruby2.2
-    apt-get install ruby2.2-dev
-
-* If you're on a Mac, follow [these instructions](https://gorails.com/setup/osx/). 
-* If you're on a Windows machine you can use the [Ruby Installer](http://rubyinstaller.org/downloads/). During the installation make sure to check the option for *Add Ruby executables to your PATH*.
-
-The remainder of the steps should work the same across operating systems.
-
-To confirm you've installed Ruby correctly, at the command prompt run `gem --version` and you should get a response with your version number. Likewise you can confirm you have Git installed properly by running `git --version`, which will respond with your version of Git.
-
-Install the GitHub Pages package, which includes Jekyll:
-
-	gem install github-pages
-
-Clone our site:
-
-	git clone https://github.com/kubernetes/kubernetes.github.io.git
-
-Make any changes you want. Then, to see your changes locally:
-
-	cd kubernetes.github.io
-	jekyll serve
-
-Your copy of the site will then be viewable at: [http://localhost:4000](http://localhost:4000)
-(or wherever Jekyll tells you).
-
-
-## GitHub help
-
-If you're a bit rusty with git/GitHub, you might wanna read
-[this](http://readwrite.com/2013/10/02/github-for-beginners-part-2) for a refresher.
-
-## Common Tasks
-
-### Edit Page Titles or Change the Left Navigation
-
-Edit the yaml files in `/_data/` for the Guides, Reference, Samples, or Support areas.
-
-You may have to exit and `jekyll clean` before restarting the `jekyll serve` to
-get changes to files in `/_data/` to show up.
-
-### Add Images
-
-Put the new image in `/images/docs/` if it's for the documentation, and just `/images/` if it's for the website.
-
-**For diagrams, we greatly prefer SVG files!**
-
-### Include code from another file
-
-To include a file that is hosted on this GitHub repo, insert this code:
-
-<pre>&#123;% include code.html language="&lt;LEXERVALUE&gt;" file="&lt;RELATIVEPATH&gt;" ghlink="&lt;PATHFROMROOT&gt;" %&#125;</pre>
-
-* `LEXERVALUE`: The language in which the file was written; must be [a value supported by Rouge](https://github.com/jneen/rouge/wiki/list-of-supported-languages-and-lexers).
-* `RELATIVEPATH`: The path to the file you're including, relative to the current file.
-* `PATHFROMROOT`: The path to the file relative to root, e.g. `/docs/admin/foo.yaml`
-
-To include a file that is hosted in the external, main Kubernetes repo, make sure it's added to [/update-imported-docs.sh](https://github.com/kubernetes/kubernetes.github.io/blob/master/update-imported-docs.sh), and run it so that the file gets downloaded, then enter:
-
-<pre>&#123;% include code.html language="&lt;LEXERVALUE&gt;" file="&lt;RELATIVEPATH&gt;" k8slink="&lt;PATHFROMK8SROOT&gt;" %&#125;</pre>
-
-* `PATHFROMK8SROOT`: The path to the file relative to the root of [the Kubernetes repo](https://github.com/kubernetes/kubernetes/tree/release-1.2), e.g. `/examples/rbd/foo.yaml`
-
-## Using tabs for multi-language examples
-
-By specifying some inline CSV in a varable called `tabspec`, you can include a file
-called `tabs.html` that generates tabs showing code examples in multiple langauges.
-
-<pre>&#123;% capture tabspec %&#125;servicesample
-JSON,json,service-sample.json,/docs/user-guide/services/service-sample.json
-YAML,yaml,service-sample.yaml,/docs/user-guide/services/service-sample.yaml&#123;% endcapture %&#125;
-&#123;% include tabs.html %&#125;</pre>
-
-In English, this would read: "Create a set of tabs with the alias `servicesample`,
-and have tabs visually labeled "JSON" and "YAML" that use `json` and `yaml` Rouge syntax highlighting, which display the contents of
-`service-sample.{extension}` on the page, and link to the file in GitHub at (full path)."
-
-Example file: [Pods: Multi-Container](http://kubernetes.io/docs/user-guide/pods/multi-container/).
-
-## Use a global variable
-
-The `/_config.yml` file defines some useful variables you can use when editing docs.
-
-* `page.githubbranch`: The name of the GitHub branch on the Kubernetes repo that is associated with this branch of the docs. e.g. `release-1.2`
-* `page.version` The version of Kubernetes associated with this branch of the docs. e.g. `v1.2`
-* `page.docsbranch` The name of the GitHub branch on the Docs/Website repo that you are currently using. e.g. `release-1.1` or `master`
-
-This keeps the docs you're editing aligned with the Kubernetes version you're talking about. For example, if you define a link like so, you'll never have to worry about it going stale in future doc branches:
-
-<pre>View the README [here](http://releases.k8s.io/&#123;&#123;page.githubbranch&#125;&#125;/cluster/addons/README.md).</pre>
-
-That, of course, will send users to:
-
-[http://releases.k8s.io/release-1.2/cluster/addons/README.md](http://releases.k8s.io/release-1.2/cluster/addons/README.md)
-
-(Or whatever Kubernetes release that docs branch is associated with.)
-
-## Branch structure
-
-The current version of the website is served out of the `master` branch.
-
-All versions of the site that relate to past and future versions will be named after their Kubernetes release number. For example, [the old branch for the 1.1 docs is called `release-1.1`](https://github.com/kubernetes/kubernetes.github.io/tree/release-1.1).
-
-Changes in the "docsv2" branch (where we are testing a revamp of the docs) are automatically staged here:
-http://k8sdocs.github.io/docs/tutorials/
-
-Changes in the "release-1.1" branch (for k8s v1.1 docs) are automatically staged here:
-http://kubernetes-v1-1.github.io/
-
-Changes in the "release-1.3" branch (for k8s v1.3 docs) are automatically staged here:
-http://kubernetes-v1-3.github.io/
-
-Editing of these branches will kick off a build using Travis CI that auto-updates these URLs; you can monitor the build progress at [https://travis-ci.org/kubernetes/kubernetes.github.io](https://travis-ci.org/kubernetes/kubernetes.github.io).
-
-## Config yaml guidelines
-
-Guidelines for config yamls that are included in the site docs. These
-are the yaml or json files that contain Kubernetes object
-configuration to be used with `kubectl create -f` Config yamls should
-be:
-
-* Separate deployable files, not embedded in the document, unless very
-  small variations of a full config.
-* Included in the doc with the include code
-  [above.](#include-code-from-another-file)
-* In the same directory as the doc that they are being used in
-  * If you are re-using a yaml from another doc, that is OK, just
-    leave it there, don't move it up to a higher level directory.
-* Tested in
-  [test/examples_test.go](https://github.com/kubernetes/kubernetes.github.io/blob/master/test/examples_test.go)
-* Follows
-  [best practices.](http://kubernetes.io/docs/user-guide/config-best-practices/)
-
-Don't assume the reader has this repository checked out, use `kubectl
-create -f https://github...` in example commands. For Docker images
-used in config yamls, try to use an image from an existing Kubernetes
-example. If creating an image for a doc, follow the
-[example guidelines](https://github.com/kubernetes/kubernetes/blob/master/examples/guidelines.md#throughout)
-section on "Docker images" from the Kubernetes repository.
-
-## Partners
-Kubernetes partners refers to the companies who contribute to the Kubernetes core codebase and/or extend their platform to support Kubernetes. Partners can get their logos added to the partner section of the [community page](http://k8s.io/community) by following the below steps and meeting the below logo specifications. Partners will also need to have a URL that is specific to integrating with Kubernetes ready; this URL will be the destination when the logo is clicked.
-
-* The partner product logo should be a transparent png image centered in a 215x125 px frame. (look at the existing logos for reference)
-* The logo must link to a URL that is specific to integrating with Kubernetes, hosted on the partner's site.
-* The logo should be named *product-name*_logo.png and placed in the `/images/community_logos` folder.
-* The image reference (including the link to the partner URL) should be added in `community.html` under `<div class="partner-logos" > ...</div>`.
-* Please do not change the order of the existing partner images. Append your logo to the end of the list.
-* Once completed and tested the look and feel, submit the pull request.
+* [Contributing to the Kubernetes Documentation](http://kubernetes.io/editdocs/)
+* [Creating a Documentation Pull Request](http://kubernetes.io/docs/contribute/create-pull-request/)
+* [Writing a New Topic](http://kubernetes.io/docs/contribute/write-new-topic/)
+* [Staging Your Documentation Changes](http://kubernetes.io/docs/contribute/stage-documentation-changes/)
+* [Using Page Templates](http://kubernetes.io/docs/contribute/page-templates/)
+* [Documentation Style Guide](http://kubernetes.io/docs/contribute/style-guide/)

 ## Thank you!

-Kubernetes thrives on community participation and we really appreciate your
+Kubernetes thrives on community participation, and we really appreciate your
 contributions to our site and our documentation!
@@ -1,11 +1,12 @@
 name: Kubernetes
+title: Kubernetes
+description: Production-Grade Container Orchestration
 markdown: kramdown
 kramdown:
  input: GFM
  html_to_native: true
  hard_wrap: false
  syntax_highlighter: rouge
-baseurl: /
 incremental: true

 safe: false
@@ -16,9 +17,38 @@ defaults:
    scope:
      path: ""
    values:
-      version: "v1.3"
-      githubbranch: "master"
-      docsbranch: "release-1.3"
+      version: "v1.5"
+      githubbranch: "v1.5.7"
+      docsbranch: "release-1.5"
+      versions:
+        - fullversion: "v1.9.0"
+          version: "v1.9"
+          githubbranch: "v1.9.0"
+          docsbranch: "release-1.9"
+          url: https://kubernetes.io/docs/home/
+        - fullversion: "v1.8.4"
+          version: "v1.8"
+          githubbranch: "v1.8.4"
+          docsbranch: "release-1.8"
+          url: https://v1-8.docs.kubernetes.io/docs/home/
+        - fullversion: "v1.7.3"
+          version: "v1.7"
+          githubbranch: "v1.7.3"
+          docsbranch: "release-1.7"
+          url: https://v1-7.docs.kubernetes.io/docs/home/
+        - fullversion: "v1.6.8"
+          version: "v1.6"
+          githubbranch: "v1.6.8"
+          docsbranch: "release-1.6"
+          url: https://v1-6.docs.kubernetes.io/docs/home/
+        - fullversion: "v1.5.7"
+          version: "v1.5"
+          githubbranch: "v1.5.7"
+          docsbranch: "release-1.5"
+          url: https://v1-5.docs.kubernetes.io/docs/
+      deprecated: true
+      currentUrl: https://kubernetes.io/docs/home/
+      nextUrl: http://kubernetes-io-vnext-staging.netlify.com/
  -
    scope:
      path: "docs"
@@ -27,3 +57,29 @@ defaults:
      showedit: true

 permalink: pretty
+
+gems:
+  - jekyll-redirect-from
+  - jekyll-feed
+  - jekyll-sitemap
+  - jekyll-seo-tag
+  - jekyll-include-cache
+
+include: [_headers]
+
+# SEO
+logo: /images/favicon.png
+twitter:
+  username: kubernetesio
+
+# Tables of contents, stored in the _data folder, that control the sidebar nav
+tocs:
+  - docs-home
+  - guides
+  - tutorials
+  - tasks
+  - concepts
+  - reference
+  - tools
+  - samples
+  - support
@@ -0,0 +1,74 @@
+bigheader: "Concepts"
+abstract: "Detailed explanations of Kubernetes system concepts and abstractions."
+toc:
+- docs/concepts/index.md
+
+- title: Overview
+  section:
+  - docs/concepts/overview/what-is-kubernetes.md
+  - docs/concepts/overview/components.md
+  - title: Working with Kubernetes Objects
+    section:
+    - docs/concepts/overview/working-with-objects/kubernetes-objects.md
+    - docs/concepts/overview/working-with-objects/labels.md
+    - docs/concepts/overview/working-with-objects/annotations.md
+  - docs/concepts/overview/kubernetes-api.md
+
+- title: Containers
+  section:
+  - docs/concepts/containers/images.md
+  - docs/concepts/containers/container-lifecycle-hooks.md
+
+- title: Workloads
+  section:
+  - title: Pods
+    section:
+    - docs/concepts/workloads/pods/pod-overview.md
+    - docs/concepts/workloads/pods/pod-lifecycle.md
+    - docs/concepts/workloads/pods/init-containers.md
+  - title: Controllers
+    section:
+    - docs/concepts/workloads/controllers/statefulset.md
+    - docs/concepts/workloads/controllers/petset.md
+    - docs/concepts/workloads/controllers/garbage-collection.md
+  - title: Jobs
+    section:
+    - docs/concepts/jobs/run-to-completion-finite-workloads.md
+
+- title: Cluster Administration
+  section:
+  - docs/concepts/cluster-administration/manage-deployment.md
+  - docs/concepts/cluster-administration/networking.md
+  - docs/concepts/cluster-administration/network-plugins.md
+  - docs/concepts/cluster-administration/logging.md
+  - docs/concepts/cluster-administration/audit.md
+  - docs/concepts/cluster-administration/resource-usage-monitoring.md
+  - docs/concepts/cluster-administration/out-of-resource.md
+  - docs/concepts/cluster-administration/multiple-clusters.md
+  - docs/concepts/cluster-administration/federation.md
+  - docs/concepts/cluster-administration/federation-service-discovery.md
+  - docs/concepts/cluster-administration/guaranteed-scheduling-critical-addon-pods.md
+  - docs/concepts/cluster-administration/static-pod.md
+  - docs/concepts/cluster-administration/sysctl-cluster.md
+  - docs/concepts/cluster-administration/access-cluster.md
+  - docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig.md
+
+- title: Storage
+  section:
+  - docs/concepts/storage/volumes.md
+
+- title: Services, Load Balancing, and Networking
+  section:
+  - docs/concepts/services-networking/dns-pod-service.md
+  - docs/concepts/services-networking/connect-applications-service.md
+
+- title: Configuration
+  section:
+  - docs/concepts/configuration/overview.md
+  - docs/concepts/configuration/container-command-args.md
+  - docs/concepts/configuration/manage-compute-resources-container.md
+
+- title: Policies
+  section:
+  - docs/concepts/policy/container-capabilities.md
+  - docs/concepts/policy/resource-quotas.md
@@ -0,0 +1,4 @@
+bigheader: "Kubernetes Documentation"
+abstract: "Documentation for using and learning about Kubernetes."
+toc:
+- docs/index.md
@@ -1,5 +1,10 @@
 tocs:
+- docs-home
 - guides
+- tutorials
+- tasks
+- concepts
 - reference
+- tools
 - samples
- support
+- support
@@ -1,300 +1,219 @@
 bigheader: "Guides"
-abstract: "How to get started, and achieve tasks, using Kubernetes"
+abstract: "How to get started, and accomplish tasks, using Kubernetes."
 toc:
- title: Guides
-  path: /docs/
+- docs/user-guide/index.md

- title: Getting Started
-  section:
-  - title: What is Kubernetes?
-    path: /docs/whatisk8s/
-  - title: Installing Kubernetes on Linux with kubeadm
-    path: /docs/getting-started-guides/kubeadm/
-  - title: Hello World on Google Container Engine
-    path: /docs/hellonode/
-  - title: Downloading or Building Kubernetes
-    path: /docs/getting-started-guides/binary_release/
-  - title: Online Training Course
-    path: https://www.udacity.com/course/scalable-microservices-with-kubernetes--ud615
+- docs/whatisk8s.md
+
+- docs/user-guide/index.md

 - title: Accessing the Cluster
  section:
-  - title: Installing and Setting up kubectl
-    path: /docs/user-guide/prereqs/
-  - title: Accessing Clusters
-    path: /docs/user-guide/accessing-the-cluster/
-  - title: Sharing Cluster Access with kubeconfig
-    path: /docs/user-guide/sharing-clusters/
-  - title: Authenticating Across Clusters with kubeconfig
-    path: /docs/user-guide/kubeconfig-file/
+  - docs/user-guide/prereqs.md
+  - docs/user-guide/accessing-the-cluster.md
+  - docs/user-guide/sharing-clusters.md
+  - docs/user-guide/kubeconfig-file.md

- title: User Guide
-  path: /docs/user-guide/
-
- title: Web UI (Dashboard)
-  path: /docs/user-guide/ui/
+- docs/user-guide/ui.md

 - title: Workload Deployment and Management
  section:
-  - title: Launching, Exposing, and Killing Applications
-    path: /docs/user-guide/quick-start/
-  - title: Deploying Applications
-    path: /docs/user-guide/deploying-applications/
-  - title: Managing Resources
-    path: /docs/user-guide/managing-deployments/
-  - title: Replication Controller Operations
-    path: /docs/user-guide/replication-controller/operations/
-  - title: Resizing a Replication Controller
-    path: /docs/user-guide/resizing-a-replication-controller/
-  - title: Rolling Updates
-    path: /docs/user-guide/rolling-updates/
-  - title: Rolling Update Demo
-    path: /docs/user-guide/update-demo/
-  - title: Secrets Walkthrough
-    path: /docs/user-guide/secrets/walkthrough/
-  - title: Using ConfigMap
-    path: /docs/user-guide/configmap/
-  - title: Horizontal Pod Autoscaling
-    path: /docs/user-guide/horizontal-pod-autoscaling/walkthrough/
-  - title: Best Practices for Configuration
-    path: /docs/user-guide/config-best-practices/
-  - title: Using kubectl to Manage Resources
-    path: /docs/user-guide/working-with-resources/
-  - title: Garbage Collection (Beta)
-    path: /docs/user-guide/garbage-collection/
+  - docs/user-guide/managing-deployments.md
+  - docs/user-guide/replication-controller/operations.md
+  - docs/user-guide/resizing-a-replication-controller.md
+  - docs/user-guide/rolling-updates.md
+  - docs/user-guide/update-demo/index.md
+  - docs/user-guide/configmap/index.md
+  - docs/user-guide/horizontal-pod-autoscaling/walkthrough.md
+  - docs/user-guide/config-best-practices.md
+  - docs/user-guide/working-with-resources.md
+  - docs/user-guide/garbage-collection.md
  - title: Using NetworkPolicy
    section:
-    - title: Example Walkthrough
-      path: /docs/getting-started-guides/network-policy/walkthrough/
-    - title: Using Calico for NetworkPolicy 
-      path: /docs/getting-started-guides/network-policy/calico/
+    - docs/getting-started-guides/network-policy/walkthrough.md
+    - docs/getting-started-guides/network-policy/calico.md
+    - docs/getting-started-guides/network-policy/romana.md
+    - docs/getting-started-guides/network-policy/weave.md

 - title: Batch Jobs
  section:
-  - title: Jobs
-    path: /docs/user-guide/jobs/
-  - title: Parallel Processing using Expansions
-    path: /docs/user-guide/jobs/expansions/
-  - title: Coarse Parallel Processing using a Work Queue
-    path: /docs/user-guide/jobs/work-queue-1/
-  - title: Fine Parallel Processing using a Work Queue
-    path: /docs/user-guide/jobs/work-queue-2/
+  - docs/user-guide/jobs.md
+  - docs/user-guide/jobs/expansions/index.md
+  - docs/user-guide/jobs/work-queue-1/index.md
+  - docs/user-guide/jobs/work-queue-2/index.md
+  - docs/user-guide/cron-jobs.md

 - title: Service Discovery and Load Balancing
  section:
-  - title: Connecting Applications with Services
-    path: /docs/user-guide/connecting-applications/
-  - title: Service Operations
-    path: /docs/user-guide/services/operations/
-  - title: Creating an External Load Balancer
-    path: /docs/user-guide/load-balancer/
-  - title: Configuring Your Cloud Provider's Firewalls
-    path: /docs/user-guide/services-firewalls/
-  - title: Cross-cluster Service Discovery using Federated Services
-    path: /docs/user-guide/federation/federated-services/
+  - docs/user-guide/connecting-applications.md
+  - docs/user-guide/services/operations.md
+  - docs/user-guide/load-balancer.md
+  - docs/user-guide/services-firewalls.md
+  - docs/user-guide/federation/federated-services.md

 - title: Containers and Pods
  section:
-  - title: Running Your First Containers
-    path: /docs/user-guide/simple-nginx/
-  - title: Creating Single-Container Pods
-    path: /docs/user-guide/pods/single-container/
-  - title: Creating Multi-Container Pods
-    path: /docs/user-guide/pods/multi-container/
-  - title: Configuring Containers
-    path: /docs/user-guide/configuring-containers/
-  - title: Working with Containers in Production
-    path: /docs/user-guide/production-pods/
-  - title: Commands and Capabilities
-    path: /docs/user-guide/containers/
-  - title: Using Environment Variables
-    path: /docs/user-guide/environment-guide/
-  - title: Managing Compute Resources
-    path: /docs/user-guide/compute-resources/
-  - title: The Lifecycle of a Pod
-    path: /docs/user-guide/pod-states/
-  - title: Checking Pod Health
-    path: /docs/user-guide/liveness/
-  - title: Container Lifecycle Hooks
-    path: /docs/user-guide/container-environment/
-  - title: Assigning Pods to Nodes
-    path: /docs/user-guide/node-selection/
-  - title: Using the Downward API to Convey Pod Properties
-    path: /docs/user-guide/downward-api/
-  - title: Downward API Volumes
-    path: /docs/user-guide/downward-api/volume
-  - title: Persistent Volumes Walkthrough
-    path: /docs/user-guide/persistent-volumes/walkthrough/
-  - title: Bootstrapping Pet Sets
-    path: /docs/user-guide/petset/bootstrapping/
+  - docs/user-guide/pods/multi-container.md
+  - docs/user-guide/pod-templates.md
+  - docs/user-guide/environment-guide/index.md
+  - docs/user-guide/compute-resources.md
+  - docs/user-guide/liveness/index.md
+  - docs/user-guide/container-environment.md
+  - docs/user-guide/node-selection/index.md
+  - docs/user-guide/petset/bootstrapping/index.md

 - title: Monitoring, Logging, and Debugging Containers
  section:
-  - title: Resource Usage Monitoring
-    path: /docs/user-guide/monitoring/
+  - docs/user-guide/monitoring.md
  - title: Logging
-    path: /docs/getting-started-guides/logging/
-  - title: Logging with Elasticsearch and Kibana
-    path: /docs/getting-started-guides/logging-elasticsearch/
-  - title: Running Commands in a Container with kubectl exec
-    path: /docs/user-guide/getting-into-containers/
-  - title: Connect with Proxies
-    path: /docs/user-guide/connecting-to-applications-proxy/
-  - title: Connect with Port Forwarding
-    path: /docs/user-guide/connecting-to-applications-port-forward/
+    section:
+    - docs/user-guide/logging/overview.md
+    - docs/user-guide/logging/stackdriver.md
+    - docs/user-guide/logging/elasticsearch.md
+  - docs/user-guide/connecting-to-applications-proxy.md
+  - docs/user-guide/connecting-to-applications-port-forward.md
  - title: Using Explorer to Examine the Runtime Environment
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/explorer
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/explorer

 - title: Creating a Cluster
  section:
-  - title: Picking the Right Solution
-    path: /docs/getting-started-guides/
+  - docs/getting-started-guides/index.md
  - title: Running Kubernetes on Your Local Machine
    section:
-    - title: Running Kubernetes Locally via Minikube
-      path: /docs/getting-started-guides/minikube/
-    - title: Deprecated Alternatives
-      path: /docs/getting-started-guides/alternatives/
+    - docs/getting-started-guides/minikube.md
+    - docs/getting-started-guides/alternatives.md
  - title: Running Kubernetes on Turn-key Cloud Solutions
    section:
    - title: Running Kubernetes on Google Container Engine
      path: https://cloud.google.com/container-engine/docs/before-you-begin/
-    - title: Running Kubernetes on Google Compute Engine
-      path: /docs/getting-started-guides/gce/
-    - title: Running Kubernetes on AWS EC2
-      path: /docs/getting-started-guides/aws/
-    - title: Running Kubernetes on Azure (Weave-based)
-      path: /docs/getting-started-guides/coreos/azure/
-    - title: Running Kubernetes on Azure (Flannel-based)
-      path: /docs/getting-started-guides/azure/
-    - title: Running Kubernetes on CenturyLink Cloud
-      path: /docs/getting-started-guides/clc/
+    - docs/getting-started-guides/gce.md
+    - docs/getting-started-guides/aws.md
+    - title: Running Kubernetes on Azure Container Service
+      path: https://docs.microsoft.com/en-us/azure/container-service/container-service-kubernetes-walkthrough
+    - docs/getting-started-guides/azure.md
+    - docs/getting-started-guides/clc.md
    - title: Running Kubernetes on IBM SoftLayer
      path: https://github.com/patrocinio/kubernetes-softlayer
+    - title: Running Kubernetes on Multiple Clouds with Stackpoint.io
+      path: /docs/getting-started-guides/stackpoint/
  - title: Running Kubernetes on Custom Solutions
    section:
-    - title: Creating a Custom Cluster from Scratch
-      path: /docs/getting-started-guides/scratch/
+    - docs/getting-started-guides/scratch.md
+    - docs/getting-started-guides/kubeadm.md
    - title: Custom Cloud Solutions
      section:
-      - title: CoreOS on AWS or GCE
-        path: /docs/getting-started-guides/coreos/
-      - title: Ubuntu on AWS or Joyent
-        path: /docs/getting-started-guides/juju/
-      - title: CoreOS on Rackspace
-        path: /docs/getting-started-guides/rackspace/
+      - docs/getting-started-guides/coreos/index.md
+      - docs/getting-started-guides/ubuntu/index.md
+      - docs/getting-started-guides/rackspace.md
+      - docs/getting-started-guides/kops.md
+      - docs/getting-started-guides/kargo.md
    - title: On-Premise VMs
      section:
-      - title: CoreOS on Vagrant
-        path: /docs/getting-started-guides/coreos/
-      - title: Cloudstack
-        path: /docs/getting-started-guides/cloudstack/
-      - title: VMware vSphere
-        path: /docs/getting-started-guides/vsphere/
-      - title: VMware Photon Controller
-        path: /docs/getting-started-guides/photon-controller/
-      - title: Juju
-        path: /docs/getting-started-guides/juju/
-      - title: DCOS
-        path: /docs/getting-started-guides/dcos/
-      - title: CoreOS on libvirt
-        path: /docs/getting-started-guides/libvirt-coreos/
-      - title: oVirt
-        path: /docs/getting-started-guides/ovirt/
-      - title: OpenStack Heat
-        path: /docs/getting-started-guides/openstack-heat/
-      - title: CoreOS on Multinode Cluster
-        path: /docs/getting-started-guides/coreos/coreos_multinode_cluster/
+      - docs/getting-started-guides/coreos/index.md
+      - docs/getting-started-guides/cloudstack.md
+      - docs/getting-started-guides/vsphere.md
+      - docs/getting-started-guides/photon-controller.md
+      - docs/getting-started-guides/dcos.md
+      - docs/getting-started-guides/libvirt-coreos.md
+      - docs/getting-started-guides/ovirt.md
+      - docs/getting-started-guides/openstack-heat.md
      - title: rkt
        section:
-        - title: Running Kubernetes with rkt
-          path: /docs/getting-started-guides/rkt/
-        - title: Known Issues when Using rkt
-          path: /docs/getting-started-guides/rkt/notes/
-      - title: Kubernetes on Mesos
-        path: /docs/getting-started-guides/mesos/
-      - title: Kubernetes on Mesos on Docker
-        path: /docs/getting-started-guides/mesos-docker/
+        - docs/getting-started-guides/rkt/index.md
+        - docs/getting-started-guides/rkt/notes.md
+      - docs/getting-started-guides/mesos/index.md
+      - docs/getting-started-guides/mesos-docker.md
    - title: Bare Metal
      section:
-      - title: Offline
-        path: /docs/getting-started-guides/coreos/bare_metal_offline/
-      - title: Fedora via Ansible
-        path: /docs/getting-started-guides/fedora/fedora_ansible_config/
-      - title: Fedora (Single Node)
-        path: /docs/getting-started-guides/fedora/fedora_manual_config/
-      - title: Fedora (Multi Node)
-        path: /docs/getting-started-guides/fedora/flannel_multi_node_cluster/
-      - title: CentOS
-        path: /docs/getting-started-guides/centos/centos_manual_config/
-      - title: CoreOS
-        path: /docs/getting-started-guides/coreos
-      - title: CoreOS with Calico
-        path: /docs/getting-started-guides/coreos/bare_metal_calico/
+      - docs/getting-started-guides/coreos/bare_metal_offline.md
+      - docs/getting-started-guides/fedora/fedora_ansible_config.md
+      - docs/getting-started-guides/fedora/fedora_manual_config.md
+      - docs/getting-started-guides/fedora/flannel_multi_node_cluster.md
+      - docs/getting-started-guides/centos/centos_manual_config.md
+      - docs/getting-started-guides/coreos/index.md
+      - docs/getting-started-guides/ubuntu/index.md
      - title: Ubuntu
-        path: /docs/getting-started-guides/ubuntu/
-      - title: Ubuntu Nodes with Calico
-        path: /docs/getting-started-guides/ubuntu-calico/
-    - title: Validate Node Setup
-      path: /docs/admin/node-conformance
-  - title: Portable Multi-Node Cluster
-    path: /docs/getting-started-guides/docker-multinode/
-  - title: Building Large Clusters
-    path: /docs/admin/cluster-large/
-  - title: Running in Multiple Zones
-    path: /docs/admin/multiple-zones/
-  - title: Building High-Availability Clusters
-    path: /docs/admin/high-availability/
+        section:
+        - docs/getting-started-guides/ubuntu/index.md
+        - docs/getting-started-guides/ubuntu/validation.md
+        - docs/getting-started-guides/ubuntu/backups.md
+        - docs/getting-started-guides/ubuntu/upgrades.md
+        - docs/getting-started-guides/ubuntu/scaling.md
+        - docs/getting-started-guides/ubuntu/installation.md
+        - docs/getting-started-guides/ubuntu/monitoring.md
+        - docs/getting-started-guides/ubuntu/networking.md
+        - docs/getting-started-guides/ubuntu/security.md
+        - docs/getting-started-guides/ubuntu/storage.md
+        - docs/getting-started-guides/ubuntu/troubleshooting.md
+        - docs/getting-started-guides/ubuntu/decommissioning.md
+        - docs/getting-started-guides/ubuntu/calico.md
+        - docs/getting-started-guides/ubuntu/operational-considerations.md
+        - docs/getting-started-guides/ubuntu/glossary.md
+        - docs/getting-started-guides/ubuntu/local.md
+        - docs/getting-started-guides/ubuntu/logging.md
+        - docs/getting-started-guides/ubuntu/manual.md
+      - docs/getting-started-guides/windows/index.md
+    - docs/admin/node-conformance.md
+  - docs/getting-started-guides/docker-multinode.md
+  - docs/admin/cluster-large.md
+  - docs/admin/multiple-zones.md
+  - docs/admin/high-availability/index.md
+  - docs/getting-started-guides/binary_release.md

 - title: Administering Clusters
  section:
-  - title: Admin Guide
-    path: /docs/admin/
-  - title: Cluster Management Guide
-    path: /docs/admin/cluster-management/
-  - title: Installing Addons
-    path: /docs/admin/addons/
-  - title: Sharing a Cluster with Namespaces
-    path: /docs/admin/namespaces/
-  - title: Namespaces Walkthrough
-    path: /docs/admin/namespaces/walkthrough/
-  - title: Setting Pod CPU and Memory Limits
-    path: /docs/admin/limitrange/
-  - title: Understanding Resource Quotas
-    path: /docs/admin/resourcequota/
-  - title: Applying Resource Quotas and Limits
-    path: /docs/admin/resourcequota/walkthrough/
-  - title: Kubernetes Components
-    path: /docs/admin/cluster-components/
-  - title: Configuring Kubernetes Use of etcd
-    path: /docs/admin/etcd/
-  - title: Federating Clusters
-    path: /docs/admin/federation/
-  - title: Using Multiple Clusters
-    path: /docs/admin/multi-cluster/
+  - docs/admin/index.md
+  - docs/admin/cluster-management.md
+  - docs/admin/upgrade-1-6.md
+  - docs/admin/kubeadm.md
+  - docs/admin/addons.md
+  - docs/admin/audit.md
+  - docs/admin/ha-master-gce.md
+  - docs/admin/namespaces/index.md
+  - docs/admin/namespaces/walkthrough.md
+  - docs/admin/limitrange/index.md
+  - docs/admin/disruptions.md
+  - docs/admin/resourcequota/index.md
+  - docs/admin/resourcequota/walkthrough.md
+  - docs/admin/resourcequota/limitstorageconsumption.md
+  - docs/admin/rescheduler.md
+  - docs/admin/sysctls.md
+  - docs/admin/cluster-components.md
+  - docs/admin/etcd.md
+  - docs/admin/multi-cluster.md
  - title: Changing Cluster Size
    path: https://github.com/kubernetes/kubernetes/wiki/User-FAQ#how-do-i-change-the-size-of-my-cluster/
-  - title: Configuring Multiple Schedulers
-    path: /docs/admin/multiple-schedulers/
-  - title: Networking in Kubernetes
-    path: /docs/admin/networking/
-  - title: Using DNS Pods and Services
-    path: /docs/admin/dns/
+  - docs/admin/multiple-schedulers.md
+  - docs/admin/networking.md
+  - docs/admin/dns.md
  - title: Setting Up and Configuring DNS
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/cluster-dns
-  - title: Master <-> Node Communication
-    path: /docs/admin/master-node-communication/
-  - title: Network Plugins
-    path: /docs/admin/network-plugins/
-  - title: Static Pods
-    path: /docs/admin/static-pods/
-  - title: Configuring kubelet Garbage Collection
-    path: /docs/admin/garbage-collection/
-  - title: Configuring Out Of Resource Handling
-    path: /docs/admin/out-of-resource/    
-  - title: Configuring Kubernetes with Salt
-    path: /docs/admin/salt/
-  - title: Monitoring Node Health
-    path: /docs/admin/node-problem/
-  - title: AppArmor
-    path: /docs/admin/apparmor/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/cluster-dns
+  - docs/admin/master-node-communication.md
+  - docs/admin/network-plugins.md
+  - docs/admin/static-pods.md
+  - docs/admin/garbage-collection.md
+  - docs/admin/out-of-resource.md
+  - docs/admin/salt.md
+  - docs/admin/node-problem.md
+  - docs/admin/apparmor/index.md
+
+- title: Administering Federation
+  section:
+  - docs/admin/federation/kubefed.md
+  - title: Federated Kubernetes Objects
+    section:
+    - docs/user-guide/federation/index.md
+    - docs/user-guide/federation/configmap.md
+    - docs/user-guide/federation/daemonsets.md
+    - docs/user-guide/federation/deployment.md
+    - docs/user-guide/federation/events.md
+    - docs/user-guide/federation/federated-ingress.md
+    - docs/user-guide/federation/namespaces.md
+    - docs/user-guide/federation/replicasets.md
+    - docs/user-guide/federation/secrets.md
+    - docs/federation/api-reference/index.md
+  - title: Federation Components
+    section:
+    - docs/admin/federation-apiserver.md
+    - title : federation-controller-manager
+      path: /docs/admin/federation-controller-manager
@@ -8,12 +8,10 @@ overrides:
 - path: docs/admin/kube-proxy.md
 - path: docs/admin/kube-scheduler.md
 - path: docs/admin/kubelet.md
- changedpath: docs/api-reference/extensions/v1beta1/definitions.html _includes/v1.4/extensions-v1beta1-definitions.html
- changedpath: docs/api-reference/extensions/v1beta1/operations.html _includes/v1.4/extensions-v1beta1-operations.html
- changedpath: docs/api-reference/v1/definitions.html _includes/v1.4/v1-definitions.html
- changedpath: docs/api-reference/v1/operations.html _includes/v1.4/v1-operations.html
+- changedpath: docs/api-reference/extensions/v1beta1/definitions.html _includes/v1.5/extensions-v1beta1-definitions.html
+- changedpath: docs/api-reference/extensions/v1beta1/operations.html _includes/v1.5/extensions-v1beta1-operations.html
+- changedpath: docs/api-reference/v1/definitions.html _includes/v1.5/v1-definitions.html
+- changedpath: docs/api-reference/v1/operations.html _includes/v1.5/v1-operations.html
 - copypath: k8s/federation/docs/api-reference/ docs/federation/
 - copypath: k8s/cluster/saltbase/salt/fluentd-gcp/fluentd-gcp.yaml docs/getting-started-guides/fluentd-gcp.yaml
- copypath: k8s/examples/blog-logging/counter-pod.yaml docs/getting-started-guides/counter-pod.yaml
- copypath: k8s/examples/blog-logging/counter-pod.yaml docs/user-guide/counter-pod.yaml

@@ -1,262 +1,200 @@
 bigheader: "Reference Documentation"
 abstract: "Design docs, concept definitions, and references for APIs and CLIs."
 toc:
- title: Reference Documentation
-  path: /docs/reference/
+- docs/reference.md
+
+- title: "Kubernetes Resource Types (New Docs Style)"
+  section:
+  - title: Version 1.5
+    path: /docs/resources-reference/v1.5/
+
+- title: "Kubernetes API (New Docs Style)"
+  section:
+  - title: Version 1.5
+    path: /docs/api-reference/v1.5/
+
+- title: "Kubectl Commands (New Docs Style)"
+  section:
+  - title: Version 1.5
+    path: /docs/user-guide/kubectl/v1.5/

 - title: Kubernetes API
  section:
-  - title: Kubernetes API Overview
-    path: /docs/api/
+  - docs/api.md
  - title: Accessing the API
    section:
-    - title: Overview
-      path: /docs/admin/accessing-the-api/
-    - title: Authenticating
-      path: /docs/admin/authentication/
-    - title: Using Authorization Plugins
-      path: /docs/admin/authorization/
-    - title: Using Admission Controllers
-      path: /docs/admin/admission-controllers/
-    - title: Managing Service Accounts
-      path: /docs/admin/service-accounts-admin/
-  - title: Kubernetes API Operations
-    path: /docs/api-reference/v1/operations/
-  - title: Kubernetes API Definitions
-    path: /docs/api-reference/v1/definitions/
-  - title: Kubernetes API Swagger Spec
-    path: /kubernetes/third_party/swagger-ui/
+    - docs/admin/accessing-the-api.md
+    - docs/admin/authentication.md
+    - docs/admin/authorization.md
+    - docs/admin/admission-controllers.md
+    - docs/admin/service-accounts-admin.md
+  - docs/api-reference/v1/operations.html
+  - docs/api-reference/v1/definitions.html
+  - docs/api-reference/labels-annotations-taints.md
+  - kubernetes/third_party/swagger-ui/index.md

 - title: Autoscaling API
  section:
-  - title: Autoscaling API Operations
-    path: /docs/api-reference/autoscaling/v1/operations/
-  - title: Autoscaling API Definitions
-    path: /docs/api-reference/autoscaling/v1/definitions/
+  - docs/api-reference/autoscaling/v1/operations.html
+  - docs/api-reference/autoscaling/v1/definitions.html

 - title: Batch API
  section:
-  - title: Batch API Operations
-    path: /docs/api-reference/batch/v1/operations/
-  - title: Batch API Definitions
-    path: /docs/api-reference/batch/v1/definitions/
-    
+  - docs/api-reference/batch/v1/operations.html
+  - docs/api-reference/batch/v1/definitions.html
+
+- title: Apps API
+  section:
+  - title: Apps API Operations
+    path: /docs/api-reference/apps/v1beta1/operations/
+  - title: Apps API Definitions
+    path: /docs/api-reference/apps/v1beta1/definitions/
+
 - title: Extensions API
  section:
-  - title: Extensions API Operations
-    path: /docs/api-reference/extensions/v1beta1/operations/
-  - title: Extensions API Definitions
-    path: /docs/api-reference/extensions/v1beta1/definitions/    
+  - docs/api-reference/extensions/v1beta1/operations.html
+  - docs/api-reference/extensions/v1beta1/definitions.html

 - title: kubectl CLI
  section:
-  - title: kubectl Overview
-    path: /docs/user-guide/kubectl-overview/
-  - title: kubectl for Docker Users
-    path: /docs/user-guide/docker-cli-to-kubectl/
-  - title: kubectl Usage Conventions
-    path: /docs/user-guide/kubectl-conventions/
-  - title: JSONpath Support
-    path: /docs/user-guide/jsonpath/
-  - title: kubectl Cheat Sheet
-    path: /docs/user-guide/kubectl-cheatsheet/
+  - docs/user-guide/kubectl-overview.md
+  - docs/user-guide/docker-cli-to-kubectl.md
+  - docs/user-guide/kubectl-conventions.md
+  - docs/user-guide/jsonpath.md
+  - docs/user-guide/kubectl-cheatsheet.md
  - title: kubectl Commands
    section:
-    - title: kubectl
-      path: /docs/user-guide/kubectl/kubectl/
-    - title: kubectl annotate
-      path: /docs/user-guide/kubectl/kubectl_annotate/
-    - title: kubectl api-versions
-      path: /docs/user-guide/kubectl/kubectl_api-versions/
-    - title: kubectl apply
-      path: /docs/user-guide/kubectl/kubectl_apply/
-    - title: kubectl attach
-      path: /docs/user-guide/kubectl/kubectl_attach/
-    - title: kubectl autoscale
-      path: /docs/user-guide/kubectl/kubectl_autoscale/
-    - title: kubectl cluster-info
-      path: /docs/user-guide/kubectl/kubectl_cluster-info/
-    - title: kubectl config
-      path: /docs/user-guide/kubectl/kubectl_config/
-    - title: kubectl config current-context
-      path: /docs/user-guide/kubectl/kubectl_config_current-context/
-    - title: kubectl config set-cluster
-      path: /docs/user-guide/kubectl/kubectl_config_set-cluster/
-    - title: kubectl config set-context
-      path: /docs/user-guide/kubectl/kubectl_config_set-context/
-    - title: kubectl config set-credentials
-      path: /docs/user-guide/kubectl/kubectl_config_set-credentials/
-    - title: kubectl config set
-      path: /docs/user-guide/kubectl/kubectl_config_set/
-    - title: kubectl config unset
-      path: /docs/user-guide/kubectl/kubectl_config_unset/
-    - title: kubectl config use-context
-      path: /docs/user-guide/kubectl/kubectl_config_use-context/
-    - title: kubectl config view
-      path: /docs/user-guide/kubectl/kubectl_config_view/
-    - title: kubectl convert
-      path: /docs/user-guide/kubectl/kubectl_convert/
-    - title: kubectl cordon
-      path: /docs/user-guide/kubectl/kubectl_cordon/
-    - title: kubectl create
-      path: /docs/user-guide/kubectl/kubectl_create/
-    - title: kubectl create configmap
-      path: /docs/user-guide/kubectl/kubectl_create_configmap/
-    - title: kubectl create namespace
-      path: /docs/user-guide/kubectl/kubectl_create_namespace/
-    - title: kubectl create secret docker-registry
-      path: /docs/user-guide/kubectl/kubectl_create_secret_docker-registry/
-    - title: kubectl create secret
-      path: /docs/user-guide/kubectl/kubectl_create_secret/
-    - title: kubectl create secret generic
-      path: /docs/user-guide/kubectl/kubectl_create_secret_generic/
-    - title: kubectl create serviceaccount
-      path: /docs/user-guide/kubectl/kubectl_create_serviceaccount/
-    - title: kubectl delete
-      path: /docs/user-guide/kubectl/kubectl_delete/
-    - title: kubectl describe
-      path: /docs/user-guide/kubectl/kubectl_describe/
-    - title: kubectl drain
-      path: /docs/user-guide/kubectl/kubectl_drain/
-    - title: kubectl edit
-      path: /docs/user-guide/kubectl/kubectl_edit/
-    - title: kubectl exec
-      path: /docs/user-guide/kubectl/kubectl_exec/
-    - title: kubectl explain
-      path: /docs/user-guide/kubectl/kubectl_explain/
-    - title: kubectl expose
-      path: /docs/user-guide/kubectl/kubectl_expose/
-    - title: kubectl get
-      path: /docs/user-guide/kubectl/kubectl_get/
-    - title: kubectl label
-      path: /docs/user-guide/kubectl/kubectl_label/
-    - title: kubectl logs
-      path: /docs/user-guide/kubectl/kubectl_logs/
-    - title: kubectl patch
-      path: /docs/user-guide/kubectl/kubectl_patch/
-    - title: kubectl port-forward
-      path: /docs/user-guide/kubectl/kubectl_port-forward/
-    - title: kubectl proxy
-      path: /docs/user-guide/kubectl/kubectl_proxy/
-    - title: kubectl replace
-      path: /docs/user-guide/kubectl/kubectl_replace/
-    - title: kubectl rolling-update
-      path: /docs/user-guide/kubectl/kubectl_rolling-update/
-    - title: kubectl rollout
-      path: /docs/user-guide/kubectl/kubectl_rollout/
-    - title: kubectl rollout history
-      path: /docs/user-guide/kubectl/kubectl_rollout_history/
-    - title: kubectl rollout pause
-      path: /docs/user-guide/kubectl/kubectl_rollout_pause/
-    - title: kubectl rollout resume
-      path: /docs/user-guide/kubectl/kubectl_rollout_resume/
-    - title: kubectl rollout undo
-      path: /docs/user-guide/kubectl/kubectl_rollout_undo/
-    - title: kubectl run
-      path: /docs/user-guide/kubectl/kubectl_run/
-    - title: kubectl scale
-      path: /docs/user-guide/kubectl/kubectl_scale/
-    - title: kubectl uncordon
-      path: /docs/user-guide/kubectl/kubectl_uncordon/
-    - title: kubectl version
-      path: /docs/user-guide/kubectl/kubectl_version/
+    - docs/user-guide/kubectl/index.md
+    - docs/user-guide/kubectl/kubectl_annotate.md
+    - docs/user-guide/kubectl/kubectl_api-versions.md
+    - docs/user-guide/kubectl/kubectl_apply.md
+    - docs/user-guide/kubectl/kubectl_attach.md
+    - docs/user-guide/kubectl/kubectl_autoscale.md
+    - docs/user-guide/kubectl/kubectl_certificate.md
+    - docs/user-guide/kubectl/kubectl_certificate_approve.md
+    - docs/user-guide/kubectl/kubectl_certificate_deny.md
+    - docs/user-guide/kubectl/kubectl_cluster-info.md
+    - docs/user-guide/kubectl/kubectl_cluster-info_dump.md
+    - docs/user-guide/kubectl/kubectl_completion.md
+    - docs/user-guide/kubectl/kubectl_config.md
+    - docs/user-guide/kubectl/kubectl_config_current-context.md
+    - docs/user-guide/kubectl/kubectl_config_delete-cluster.md
+    - docs/user-guide/kubectl/kubectl_config_delete-context.md
+    - docs/user-guide/kubectl/kubectl_config_get-clusters.md
+    - docs/user-guide/kubectl/kubectl_config_get-contexts.md
+    - docs/user-guide/kubectl/kubectl_config_set-cluster.md
+    - docs/user-guide/kubectl/kubectl_config_set-context.md
+    - docs/user-guide/kubectl/kubectl_config_set-credentials.md
+    - docs/user-guide/kubectl/kubectl_config_set.md
+    - docs/user-guide/kubectl/kubectl_config_unset.md
+    - docs/user-guide/kubectl/kubectl_config_use-context.md
+    - docs/user-guide/kubectl/kubectl_config_view.md
+    - docs/user-guide/kubectl/kubectl_convert.md
+    - docs/user-guide/kubectl/kubectl_cordon.md
+    - docs/user-guide/kubectl/kubectl_cp.md
+    - docs/user-guide/kubectl/kubectl_create.md
+    - docs/user-guide/kubectl/kubectl_create_configmap.md
+    - docs/user-guide/kubectl/kubectl_create_deployment.md
+    - docs/user-guide/kubectl/kubectl_create_namespace.md
+    - docs/user-guide/kubectl/kubectl_create_quota.md
+    - docs/user-guide/kubectl/kubectl_create_secret_docker-registry.md
+    - docs/user-guide/kubectl/kubectl_create_secret.md
+    - docs/user-guide/kubectl/kubectl_create_secret_generic.md
+    - docs/user-guide/kubectl/kubectl_create_secret_tls.md
+    - docs/user-guide/kubectl/kubectl_create_serviceaccount.md
+    - docs/user-guide/kubectl/kubectl_create_service_clusterip.md
+    - docs/user-guide/kubectl/kubectl_create_service_loadbalancer.md
+    - docs/user-guide/kubectl/kubectl_create_service_nodeport.md
+    - docs/user-guide/kubectl/kubectl_delete.md
+    - docs/user-guide/kubectl/kubectl_describe.md
+    - docs/user-guide/kubectl/kubectl_drain.md
+    - docs/user-guide/kubectl/kubectl_edit.md
+    - docs/user-guide/kubectl/kubectl_exec.md
+    - docs/user-guide/kubectl/kubectl_explain.md
+    - docs/user-guide/kubectl/kubectl_expose.md
+    - docs/user-guide/kubectl/kubectl_get.md
+    - docs/user-guide/kubectl/kubectl_label.md
+    - docs/user-guide/kubectl/kubectl_logs.md
+    - docs/user-guide/kubectl/kubectl_options.md
+    - docs/user-guide/kubectl/kubectl_patch.md
+    - docs/user-guide/kubectl/kubectl_port-forward.md
+    - docs/user-guide/kubectl/kubectl_proxy.md
+    - docs/user-guide/kubectl/kubectl_replace.md
+    - docs/user-guide/kubectl/kubectl_rolling-update.md
+    - docs/user-guide/kubectl/kubectl_rollout.md
+    - docs/user-guide/kubectl/kubectl_rollout_history.md
+    - docs/user-guide/kubectl/kubectl_rollout_pause.md
+    - docs/user-guide/kubectl/kubectl_rollout_resume.md
+    - docs/user-guide/kubectl/kubectl_rollout_status.md
+    - docs/user-guide/kubectl/kubectl_rollout_undo.md
+    - docs/user-guide/kubectl/kubectl_run.md
+    - docs/user-guide/kubectl/kubectl_scale.md
+    - docs/user-guide/kubectl/kubectl_set.md
+    - docs/user-guide/kubectl/kubectl_set_image.md
+    - docs/user-guide/kubectl/kubectl_set_resources.md
+    - docs/user-guide/kubectl/kubectl_taint.md
+    - docs/user-guide/kubectl/kubectl_top.md
+    - docs/user-guide/kubectl/kubectl_top_node.md
+    - docs/user-guide/kubectl/kubectl_top_pod.md
+    - docs/user-guide/kubectl/kubectl_uncordon.md
+    - docs/user-guide/kubectl/kubectl_version.md
    - title: Superseded and Deprecated Commands
      section:
-      - title: kubectl namespace
-        path: /docs/user-guide/kubectl/kubectl_namespace/
-      - title: kubectl stop
-        path: /docs/user-guide/kubectl/kubectl_stop/
+      - /docs/user-guide/kubectl/kubectl_namespace/
+      - docs/user-guide/kubectl/kubectl_stop.md

 - title: Kubernetes Components
  section:
-  - title: kube-apiserver
-    path: /docs/admin/kube-apiserver/
-  - title: kube-controller-manager
-    path: /docs/admin/kube-controller-manager/    
-  - title: kube-proxy
-    path: /docs/admin/kube-proxy/
-  - title: kube-scheduler
-    path: /docs/admin/kube-scheduler/
+  - docs/admin/kube-apiserver.md
+  - docs/admin/kube-controller-manager.md
+  - docs/admin/kube-proxy.md
+  - docs/admin/kube-scheduler.md
  - title: kubelet
-    path: /docs/admin/kubelet/
+    section:
+    - docs/admin/kubelet.md
+    - docs/admin/master-node-communication.md
+    - docs/admin/kubelet-tls-bootstrapping.md
+    - docs/admin/kubelet-authentication-authorization.md

 - title: Glossary
  section:
-  - title: Annotations
-    path: /docs/user-guide/annotations/  
-  - title: Daemon Sets
-    path: /docs/admin/daemons/
-  - title: Deployments    
-    path: /docs/user-guide/deployments/
-  - title: Horizontal Pod Autoscaling
-    path: /docs/user-guide/horizontal-pod-autoscaling/    
-  - title: Images
-    path: /docs/user-guide/images/
-  - title: Ingress Resources
-    path: /docs/user-guide/ingress/    
-  - title: Jobs
-    path: /docs/user-guide/jobs/    
-  - title: Labels and Selectors
-    path: /docs/user-guide/labels/
-  - title: Names
-    path: /docs/user-guide/identifiers/
-  - title: Namespaces
-    path: /docs/user-guide/namespaces/
-  - title: Network Policies 
-    path: /docs/user-guide/networkpolicies/    
-  - title: Nodes
-    path: /docs/admin/node/    
-  - title: Persistent Volumes
-    path: /docs/user-guide/persistent-volumes/    
-  - title: Pet Sets
-    path: /docs/user-guide/petset/    
-  - title: Pods
-    path: /docs/user-guide/pods/
-  - title: Pod Security Policies
-    path: /docs/user-guide/pod-security-policy/
-  - title: Replica Sets
-    path: /docs/user-guide/replicasets/
-  - title: Replication Controller
-    path: /docs/user-guide/replication-controller/    
-  - title: Resource Quotas
-    path: /docs/admin/resource-quota/    
-  - title: Scheduled Jobs
-    path: /docs/user-guide/scheduled-jobs/
-  - title: Secrets
-    path: /docs/user-guide/secrets/
-  - title: Security Context
-    path: /docs/user-guide/security-context/
-  - title: Services
-    path: /docs/user-guide/services/
-  - title: Service Accounts
-    path: /docs/user-guide/service-accounts/
-  - title: Volumes
-    path: /docs/user-guide/volumes/
+  - docs/user-guide/annotations.md
+  - docs/admin/daemons.md
+  - docs/user-guide/deployments.md
+  - docs/user-guide/horizontal-pod-autoscaling/index.md
+  - docs/user-guide/images.md
+  - docs/user-guide/ingress.md
+  - docs/user-guide/jobs.md
+  - docs/user-guide/labels.md
+  - docs/user-guide/identifiers.md
+  - docs/user-guide/namespaces.md
+  - docs/user-guide/networkpolicies.md
+  - docs/admin/node.md
+  - docs/user-guide/persistent-volumes/index.md
+  - docs/user-guide/petset.md
+  - docs/user-guide/pods/index.md
+  - docs/user-guide/pod-security-policy/index.md
+  - docs/user-guide/replicasets.md
+  - docs/user-guide/replication-controller/index.md
+  - docs/admin/resourcequota/index.md
+  - docs/user-guide/cron-jobs.md
+  - docs/user-guide/secrets/index.md
+  - docs/user-guide/security-context.md
+  - docs/user-guide/services/index.md
+  - docs/user-guide/service-accounts.md
+  - docs/user-guide/thirdpartyresources.md
+  - docs/user-guide/volumes.md

 - title: Kubernetes Design Docs
  section:
  - title: Kubernetes Architecture
-    path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/architecture.md
+    path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/architecture.md
  - title: Kubernetes Design Overview
-    path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/
+    path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/
  - title: Kubernetes Identity and Access Management
-    path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/access.md
-  - title: Kubernetes OpenVSwitch GRE/VxLAN networking
-    path: /docs/admin/ovs-networking/    
+    path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/access.md
+  - docs/admin/ovs-networking.md
  - title: Security Contexts
-    path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/security_context.md
+    path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/security_context.md
  - title: Security in Kubernetes
-    path: https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/security.md    
-
- title: Federation
-  section:
-  - title: User guide
-    path: /docs/user-guide/federation/
-  - title: Federation API
-    path: /docs/federation/api-reference/README/
-  - title: Federation Components
-    section:
-    - title: federation-apiserver
-      path: /docs/admin/federation-apiserver.md
-    - title : federation-controller-mananger
-      path: /docs/admin/federation-controller-manager.md
+    path: https://github.com/kubernetes/kubernetes/blob/release-1.5/docs/design/security.md
@@ -1,77 +1,75 @@
 bigheader: "Samples"
 abstract: "A collection of example applications that show how to use Kubernetes."
 toc:
- title: Samples
-  path: /docs/samples/
+- docs/samples.md

 - title: Storage / Database / KV
  section:
  - title: Apache Cassandra Database
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/cassandra
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/cassandra
  - title: Ceph
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/rbd/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/rbd/
  - title: CephFS
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/cephfs/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/cephfs/
+  - title: CockroachDB
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.4/examples/cockroachdb/
  - title: GlusterFS
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/glusterfs/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/glusterfs/
  - title: Hazelcast
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/hazelcast
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/hazelcast
  - title: iSCSI
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/iscsi/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/iscsi/
  - title: MySQL Galera
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/mysql-galera
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/mysql-galera
  - title: NFS
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/nfs/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/volumes/nfs/
  - title: Redis
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/redis/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/redis/
  - title: RethinkDB
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/rethinkdb/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/rethinkdb/
  - title: Vitess
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/vitess/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/vitess/

 - title: Big Data
  section:
  - title: Apache Spark
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/spark
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/spark
  - title: Apache Storm
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/storm
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storm

 - title: Messaging / Queueing
  section:
-  - title: Celery + RabbitMQ
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/celery-rabbitmq
  - title: Hazelcast
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/hazelcast
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/storage/hazelcast

 - title: Miscellaneous
  section:
  - title: Meteor Applications
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/meteor/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/meteor/
  - title: OpenShift Origin
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/openshift-origin/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/openshift-origin/
  - title: Selenium
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/selenium/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/selenium/

 - title: Monitoring and Logging
  section:
  - title: Elasticsearch
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/elasticsearch/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/elasticsearch/
  - title: NewRelic
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/newrelic
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/newrelic

 - title: Multi-tier Applications
  section:
  - title: Guestbook - Go Server
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/guestbook-go/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/guestbook-go/
  - title: GuestBook - PHP Server
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/guestbook/
-  - title: MEAN stack on Google Cloud Platform
-    path: /docs/getting-started-guides/meanstack/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/guestbook/
+  - docs/getting-started-guides/meanstack.md
  - title: MySQL + Wordpress
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/mysql-wordpress-pd/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/mysql-wordpress-pd/
  - title: MySQL + Phabricator Server
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/phabricator/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/phabricator/
  - title: Nodejs + Mongo
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/nodesjs-mongodb
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/nodesjs-mongodb
  - title: Petstore
-    path: https://github.com/kubernetes/kubernetes/tree/release-1.3/examples/k8petstore/
+    path: https://github.com/kubernetes/kubernetes/tree/release-1.5/examples/k8petstore/
@@ -1,23 +1,15 @@
 bigheader: "Support"
 abstract: "Troubleshooting resources, frequently asked questions, and community support channels."
 toc:
- title: Support
-  path: /docs/troubleshooting/
+- docs/troubleshooting.md

 - title: Troubleshooting
  section:
-  - title: Debugging Pods and Replication Controllers
-    path: /docs/user-guide/debugging-pods-and-replication-controllers/
-  - title: Application Introspection and Debugging
-    path: /docs/user-guide/introspection-and-debugging/
-  - title: Retrieving Logs
-    path: /docs/user-guide/logging/
-  - title: Troubleshooting Applications
-    path: /docs/user-guide/application-troubleshooting/
-  - title: Troubleshooting Clusters
-    path: /docs/admin/cluster-troubleshooting/
-  - title: Debugging Services
-    path: /docs/user-guide/debugging-services/
+  - docs/user-guide/debugging-pods-and-replication-controllers.md
+  - docs/user-guide/introspection-and-debugging.md
+  - docs/user-guide/application-troubleshooting.md
+  - docs/admin/cluster-troubleshooting.md
+  - docs/user-guide/debugging-services.md

 - title: Frequently Asked Questions
  section:
@@ -28,17 +20,25 @@ toc:
  - title: Services FAQ
    path: https://github.com/kubernetes/kubernetes/wiki/Services-FAQ/

+- title: Contributing to the Kubernetes Docs
+  section:
+  - editdocs.md
+  - docs/contribute/create-pull-request.md
+  - docs/contribute/write-new-topic.md
+  - docs/contribute/stage-documentation-changes.md
+  - docs/contribute/page-templates.md
+  - docs/contribute/review-issues.md
+  - docs/contribute/style-guide.md
+
 - title: Other Resources
  section:
  - title: Kubernetes Issue Tracker on GitHub
    path: https://github.com/kubernetes/kubernetes/issues/
-  - title: Report a Security Vulnerability
-    path: /docs/reporting-security-issues/
+  - docs/reporting-security-issues.md
  - title: Release Notes
    path: https://github.com/kubernetes/kubernetes/releases/
  - title: Release Roadmap
    path: https://github.com/kubernetes/kubernetes/milestones/
-  - title: Contributing to Kubernetes Documentation
-    path: /editdocs/
-  - title: New Template Instructions
-    path: /docs/templatedemos/
+
+- title: Deprecation Policy
+  path: /docs/deprecation-policy.md
@@ -0,0 +1,87 @@
+bigheader: "Tasks"
+abstract: "Step-by-step instructions for performing operations with Kubernetes."
+toc:
+- docs/tasks/index.md
+
+- title: Using the kubectl Command-Line
+  section:
+  - docs/tasks/kubectl/install.md
+  - docs/tasks/kubectl/list-all-running-container-images.md
+  - docs/tasks/kubectl/get-shell-running-container.md
+
+- title: Configuring Pods and Containers
+  section:
+  - docs/tasks/configure-pod-container/define-environment-variable-container.md
+  - docs/tasks/configure-pod-container/define-command-argument-container.md
+  - docs/tasks/configure-pod-container/assign-cpu-ram-container.md
+  - docs/tasks/configure-pod-container/limit-range.md
+  - docs/tasks/configure-pod-container/apply-resource-quota-limit.md
+  - docs/tasks/configure-pod-container/configure-volume-storage.md
+  - docs/tasks/configure-pod-container/configure-persistent-volume-storage.md
+  - docs/tasks/configure-pod-container/environment-variable-expose-pod-information.md
+  - docs/tasks/configure-pod-container/downward-api-volume-expose-pod-information.md
+  - docs/tasks/configure-pod-container/distribute-credentials-secure.md
+  - docs/tasks/configure-pod-container/pull-image-private-registry.md
+  - docs/tasks/configure-pod-container/configure-liveness-readiness-probes.md
+  - docs/tasks/configure-pod-container/communicate-containers-same-pod.md
+  - docs/tasks/configure-pod-container/configure-pod-initialization.md
+  - docs/tasks/configure-pod-container/attach-handler-lifecycle-event.md
+  - docs/tasks/configure-pod-container/configure-pod-disruption-budget.md
+
+- title: Running Applications
+  section:
+  - docs/tasks/run-application/rolling-update-replication-controller.md
+
+- title: Running Jobs
+  section:
+  - docs/tasks/job/parallel-processing-expansion.md
+  - docs/tasks/job/coarse-parallel-processing-work-queue/index.md
+  - docs/tasks/job/fine-parallel-processing-work-queue/index.md
+
+- title: Accessing Applications in a Cluster
+  section:
+  - docs/tasks/access-application-cluster/port-forward-access-application-cluster.md
+  - docs/tasks/access-application-cluster/load-balance-access-application-cluster.md
+  - docs/tasks/access-application-cluster/create-external-load-balancer.md
+  - docs/tasks/access-application-cluster/configure-cloud-provider-firewall.md
+
+- title: Monitoring, Logging, and Debugging
+  section:
+  - docs/tasks/debug-application-cluster/determine-reason-pod-failure.md
+  - docs/tasks/debug-application-cluster/debug-init-containers.md
+  - docs/tasks/debug-application-cluster/logging-stackdriver.md
+  - docs/tasks/debug-application-cluster/monitor-node-health.md
+  - docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md
+
+- title: Accessing the Kubernetes API
+  section:
+  - docs/tasks/access-kubernetes-api/http-proxy-access-api.md
+
+- title: Administering a Cluster
+  section:
+  - docs/tasks/administer-cluster/overview.md
+  - docs/tasks/administer-cluster/assign-pods-nodes.md
+  - docs/tasks/administer-cluster/dns-horizontal-autoscaling.md
+  - docs/tasks/administer-cluster/safely-drain-node.md
+  - docs/tasks/administer-cluster/change-pv-reclaim-policy.md
+  - docs/tasks/administer-cluster/limit-storage-consumption.md
+  - docs/tasks/administer-cluster/share-configuration.md
+
+- title: Administering Federation
+  section:
+  - docs/tasks/administer-federation/configmap.md
+  - docs/tasks/administer-federation/daemonset.md
+  - docs/tasks/administer-federation/deployment.md
+  - docs/tasks/administer-federation/events.md
+  - docs/tasks/administer-federation/ingress.md
+  - docs/tasks/administer-federation/namespaces.md
+  - docs/tasks/administer-federation/replicaset.md
+  - docs/tasks/administer-federation/secret.md
+
+- title: Managing Stateful Applications
+  section:
+  - docs/tasks/manage-stateful-set/upgrade-pet-set-to-stateful-set.md
+  - docs/tasks/manage-stateful-set/scale-stateful-set.md
+  - docs/tasks/manage-stateful-set/deleting-a-statefulset.md
+  - docs/tasks/manage-stateful-set/debugging-a-statefulset.md
+  - docs/tasks/manage-stateful-set/delete-pods.md
@@ -0,0 +1,22 @@
+bigheader: "Tools"
+abstract: "Tools to help you use and enhance Kubernetes."
+toc:
+- docs/tools/index.md
+
+- title: Native Tools
+  section:
+  - title: Kubectl
+    path: /docs/user-guide/kubectl/
+  - title: Kubeadm
+    path: /docs/getting-started-guides/kubeadm
+  - title: Kubefed
+    path: /docs/admin/federation/kubefed/
+  - title: Kubernetes Dashboard
+    path: /docs/user-guide/ui/
+  
+- title: Third-Party Tools
+  section:
+  - docs/tools/kompose/index.md
+  - docs/tools/kompose/user-guide.md
+  - title: Helm
+    path: https://github.com/kubernetes/helm
@@ -0,0 +1,64 @@
+bigheader: "Tutorials"
+abstract: "Detailed walkthroughs of common Kubernetes operations and workflows."
+toc:
+- docs/tutorials/index.md
+- title: Kubernetes Basics
+  section:
+  - docs/tutorials/kubernetes-basics/index.html
+  - title: 1. Create a Cluster
+    section:
+    - docs/tutorials/kubernetes-basics/cluster-intro.html
+    - docs/tutorials/kubernetes-basics/cluster-interactive.html
+  - title: 2. Deploy an App
+    section:
+    - docs/tutorials/kubernetes-basics/deploy-intro.html
+    - docs/tutorials/kubernetes-basics/deploy-interactive.html
+  - title: 3. Explore Your App
+    section:
+    - docs/tutorials/kubernetes-basics/explore-intro.html
+    - docs/tutorials/kubernetes-basics/explore-interactive.html
+  - title: 4. Expose Your App Publicly
+    section:
+    - docs/tutorials/kubernetes-basics/expose-intro.html
+    - docs/tutorials/kubernetes-basics/expose-interactive.html
+  - title: 5. Scale Your App
+    section:
+    - docs/tutorials/kubernetes-basics/scale-intro.html
+    - docs/tutorials/kubernetes-basics/scale-interactive.html
+  - title: 6. Update Your App
+    section:
+    - docs/tutorials/kubernetes-basics/update-intro.html
+    - docs/tutorials/kubernetes-basics/update-interactive.html
+- title: Online Training Course
+  path: https://www.udacity.com/course/scalable-microservices-with-kubernetes--ud615
+- docs/tutorials/stateless-application/hello-minikube.md
+- title: Object Management Using kubectl
+  section:
+  - docs/tutorials/object-management-kubectl/object-management.md
+  - docs/tutorials/object-management-kubectl/imperative-object-management-command.md
+  - docs/tutorials/object-management-kubectl/imperative-object-management-configuration.md
+  - docs/tutorials/object-management-kubectl/declarative-object-management-configuration.md
+- title: Stateless Applications
+  section:
+  - docs/tutorials/stateless-application/run-stateless-application-deployment.md
+  - docs/tutorials/stateless-application/expose-external-ip-address-service.md
+  - docs/tutorials/stateless-application/expose-external-ip-address.md
+  - docs/tutorials/stateless-application/run-stateless-ap-replication-controller.md
+- title: Stateful Applications
+  section:
+  - docs/tutorials/stateful-application/basic-stateful-set.md
+  - docs/tutorials/stateful-application/run-stateful-application.md
+  - docs/tutorials/stateful-application/run-replicated-stateful-application.md
+  - docs/tutorials/stateful-application/zookeeper.md
+- title: Connecting Applications
+  section:
+  - docs/tutorials/connecting-apps/connecting-frontend-backend.md
+- title: Clusters
+  section:
+  - docs/tutorials/clusters/apparmor.md
+- title: Services
+  section:
+  - docs/tutorials/services/source-ip.md
+- title: Federated Cluster Administration
+  section:
+  - docs/tutorials/federation/set-up-cluster-federation-kubefed.md
@@ -0,0 +1,3 @@
+# Prevent bots from indexing site
+/*
+  X-Robots-Tag: noindex
@@ -0,0 +1 @@
+***NOTE: This feature is beta in Kubernetes 1.5.***
@@ -7,5 +7,20 @@
 ```
 {: id="{{include.file | handleize}}"}
 {% endcapture %}
-<table class="includecode"><thead><tr><th>{% if ghlink %}<a href="{{ghlink}}" download="{{include.file}}">{% endif %}<code>{{include.file}}</code></a><img src="/images/copycode.svg" style="max-height:24px" onClick="copyCode('{{include.file | handleize}}')" title="Copy {{include.file}} to clipboard"></th></tr></thead>
-<tr><td>{{ mysample | markdownify }}</td></tr></table>
+<table class="includecode">
+    <thead>
+        <tr>
+            <th>
+                {% if ghlink %}<a href="{{ghlink}}" download="{{include.file}}">{% endif %}
+                    <code>{{include.file}}</code>
+                {% if ghlink %}</a>{% endif %}
+                <img src="/images/copycode.svg" style="max-height:24px" onclick="copyCode('{{include.file | handleize}}')" title="Copy {{include.file}} to clipboard">
+            </th>
+        </tr>
+    </thead>
+    <tbody>
+        <tr>
+            <td>{{ mysample | markdownify }}</td>
+        </tr>
+    </tbody>
+</table>
@@ -0,0 +1,6 @@
+You need to either have a dynamic PersistentVolume provisioner with a default
+[StorageClass](/docs/user-guide/persistent-volumes/#storageclasses),
+or [statically provision PersistentVolumes](/docs/user-guide/persistent-volumes/#provisioning)
+yourself to satisfy the [PersistentVolumeClaims](/docs/user-guide/persistent-volumes/#persistentvolumeclaims)
+used here.
+
@@ -0,0 +1,12 @@
+{% if page.deprecated %}
+<section id="deprecationWarning">
+  <main>
+    <div class="content deprecation-warning">
+      <h3>
+        Documentation for Kubernetes {{ page.version}} is no longer actively maintained. The version you are currently viewing is a static snapshot.
+        For up-to-date documentation, see the <a href="{{ page.currentUrl }}">latest</a> version.
+      </h3>
+    </div>
+  </main>
+</section>
+{% endif %}
@@ -0,0 +1,53 @@
+<button class="flyout-button" onclick="kub.toggleToc()"></button>
+
+<style>
+.cse .gsc-control-cse, .gsc-control-cse, {
+    padding: 0;
+}
+  .gsc-control-cse table, .gsc-control-cse-en table {
+      margin:0px !important;
+  }
+  .gsc-above-wrapper-area {
+      border-bottom: 0;
+  }
+</style>
+
+<script>
+(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
+    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
+m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
+})(window,document,'script','//www.google-analytics.com/analytics.js','ga');
+ga('create', 'UA-36037335-10', 'auto');
+ga('send', 'pageview');
+
+// hide docs nav area if no nav is present, or if nav only contains a link to the current page
+(function () {
+    window.addEventListener('DOMContentLoaded', init)
+
+        // play nice with our neighbors
+        function init() {
+            window.removeEventListener('DOMContentLoaded', init)
+                hideNav()
+        }
+
+    function hideNav(toc){
+        if (!toc) toc = document.querySelector('#docsToc')
+            var container = toc.querySelector('.container')
+
+                // container is built dynamically, so it may not be present on the first runloop
+                if (container) {
+                    if (container.childElementCount === 0 || toc.querySelectorAll('a.item').length === 1) {
+                        toc.style.display = 'none'
+                            document.getElementById('docsContent').style.width = '100%'
+                    }
+                } else {
+                    requestAnimationFrame(function () {
+                        hideNav(toc)
+                    })
+                }
+    }
+})();
+</script>
+
+<!-- Commenting out AnswerDash for now; we need to work on our list of questions/answers/design first
+    <!-- Start of AnswerDash script <script>var AnswerDash;!function(e,t,n,s,a){if(!t.getElementById(s)){var i,r=t.createElement(n),c=t.getElementsByTagName(n)[0];e[a]||(i=e[a]=function(){i.__oninit.push(arguments)},i.__oninit=[]),r.type="text/javascript",r.async=!0,r.src="https://p1.answerdash.com/answerdash.min.js?siteid=756",r.setAttribute("id",s),c.parentNode.insertBefore(r,c)}}(window,document,"script","answerdash-script","AnswerDash");</script> <!-- End of AnswerDash script -->
@@ -1,25 +1,34 @@
 <footer>
-	<main class="light-text">
-		<nav>
-			<a href="/docs/hellonode/">Get Started</a>
-			<a href="/docs/">Documentation</a>
-			<a href="http://blog.kubernetes.io/">Blog</a>
-			<a href="/community/">Community</a>
-		</nav>
-		<div class="social">
-			<div>
-				<a href="https://twitter.com/kubernetesio" class="twitter"><span>twitter</span></a>
-				<a href="https://github.com/kubernetes/kubernetes" class="github"><span>Github</span></a>
-				<a href="http://slack.k8s.io/" class="slack"><span>Slack</span></a>
-			</div>
-			<div>
-				<a href="http://stackoverflow.com/questions/tagged/kubernetes" class="stack-overflow"><span>Stack Overflow</span></a>
-				<a href="https://groups.google.com/forum/#!forum/kubernetes-users" class="mailing-list"><span>Mailing List</span></a>
-				<a href="https://calendar.google.com/calendar/embed?src=nt2tcnbtbied3l6gi2h29slvc0%40group.calendar.google.com" class="calendar"><span>Events Calendar</span></a>
-			</div>
-			<div>
-			</div>
-		</div>
-		<div id="miceType" class="center">&copy; {{ 'now' | date: "%Y" }} Kubernetes</div>
-	</main>
+    <main class="light-text">
+        <nav>
+            <a href="/docs/hellonode/">Get Started</a>
+            <a href="/docs/">Documentation</a>
+            <a href="http://blog.kubernetes.io/">Blog</a>
+            <a href="/partners/">Partners</a>
+            <a href="/community/">Community</a>
+            <a href="/case-studies/">Case Studies</a>
+        </nav>
+        <div class="social">
+            <div>
+                <a href="https://twitter.com/kubernetesio" class="twitter"><span>twitter</span></a>
+                <a href="https://github.com/kubernetes/kubernetes" class="github"><span>Github</span></a>
+                <a href="http://slack.k8s.io/" class="slack"><span>Slack</span></a>
+            </div>
+            <div>
+                <a href="http://stackoverflow.com/questions/tagged/kubernetes" class="stack-overflow"><span>Stack Overflow</span></a>
+                <a href="https://groups.google.com/forum/#!forum/kubernetes-users" class="mailing-list"><span>Mailing List</span></a>
+                <a href="https://calendar.google.com/calendar/embed?src=nt2tcnbtbied3l6gi2h29slvc0%40group.calendar.google.com" class="calendar"><span>Events Calendar</span></a>
+            </div>
+            <div>
+                <a href="//get.k8s.io" class="button">Download K8s</a>
+                <a href="https://github.com/kubernetes/kubernetes" class="button">Contribute to the K8s codebase</a>
+            </div>
+        </div>
+        <div id="miceType" class="center">
+            &copy; {{ 'now' | date: "%Y" }} The Kubernetes Authors | Documentation Distributed under <a href="https://github.com/kubernetes/kubernetes.github.io/blob/master/LICENSE" class="light-text">CC BY 4.0</a>
+        </div>
+        <div id="miceType" class="center">
+            Copyright &copy; {{ 'now' | date: "%Y" }} The Linux Foundation&reg;. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page: <a href="https://www.linuxfoundation.org/trademark-usage" class="light-text">https://www.linuxfoundation.org/trademark-usage</a>
+        </div>
+    </main>
 </footer>
@@ -1,67 +0,0 @@
-{% if page.title %}{% assign title=page.title %}{% endif %}
-<head>
-	<meta charset="utf-8">
-	<meta name="viewport" content="width=device-width, initial-scale=1">
-	<link rel="canonical" href="http://kubernetes.io{{page.url}}" />
-	<link rel="shortcut icon" type="image/png" href="/images/favicon.png">
-	<link href='https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900,900italic' rel='stylesheet' type='text/css'>
-	<link rel="stylesheet" href='https://fonts.googleapis.com/css?family=Roboto+Mono' type='text/css'>
-	<link rel="stylesheet" href="/css/styles.css"/>
-        <link rel="stylesheet" href="/css/jquery-ui.min.css">
-        <link rel="stylesheet" href="/css/sweetalert.css">
-	<script src="/js/jquery-2.2.0.min.js"></script>
-        <script src="/js/jquery-ui.min.js"></script>
-	<script src="/js/script.js"></script>
-        <script src="/js/sweetalert.min.js"></script>
-	<title>Kubernetes - {{ title }}</title>
-</head>
-<body>
-<div id="cellophane" onclick="kub.toggleMenu()"></div>
-<header>
-	<a href="/" class="logo"></a>
-	<div class="nav-buttons" data-auto-burger="primary">
-		<a href="/docs/" class="button" id="viewDocs" data-auto-burger-exclude>View Documentation</a>
-		<a href="/docs/hellonode/" class="button" id="tryKubernetes" data-auto-burger-exclude>Try Kubernetes</a>
-		<button id="hamburger" onclick="kub.toggleMenu()" data-auto-burger-exclude><div></div></button>
-	</div>
-
-	<nav id="mainNav">
-		<main data-auto-burger="primary">
-			<div class="nav-box">
-				<h3><a href="/docs/hellonode/">Get Started</a></h3>
-				<p>Ready to get your hands dirty? Build a simple Kubernetes cluster that runs "Hello World" for Node.js.</p>
-			</div>
-			<div class="nav-box">
-				<h3><a href="/docs/">Documentation</a></h3>
-				<p>Learn how to use Kubernetes with the use of walkthroughs, samples, and reference documentation. You can even <a href="/editdocs/" data-auto-burger-exclude>help contribute to the docs</a>!</p>
-			</div>
-			<div class="nav-box">
-				<h3><a href="/community/">Community</a></h3>
-				<p>If you need help, you can connect with other Kubernetes users and the Kubernetes authors, attend community events, and watch video presentations from around the web.</p>
-			</div>
-			<div class="nav-box">
-				<h3><a href="http://blog.kubernetes.io">Blog</a></h3>
-				<p>Read the latest news for Kubernetes and the containers space in general, and get technical how-tos hot off the presses.</p>
-			</div>
-		</main>
-		<main data-auto-burger="primary">
-			<div class="left">
-				<h5 class="github-invite">Interested in hacking on the core Kubernetes code base?</h5>
-				<a href="https://github.com/kubernetes/kubernetes" class="button" data-auto-burger-exclude>View On Github</a>
-			</div>
-
-			<div class="right">
-				<h5 class="github-invite">Explore the community</h5>
-				<div class="social">
-					<a href="https://twitter.com/kubernetesio" class="twitter"><span>Twitter</span></a>
-					<a href="https://github.com/kubernetes/kubernetes" class="github"><span>Github</span></a>
-					<a href="http://slack.k8s.io/" class="slack"><span>Slack</span></a>
-					<a href="http://stackoverflow.com/questions/tagged/kubernetes" class="stack-overflow"><span>Stack Overflow</span></a>
-					<a href="https://groups.google.com/forum/#!forum/kubernetes-users" class="mailing-list"><span>Mailing List</span></a>
-					<a href="https://calendar.google.com/calendar/embed?src=nt2tcnbtbied3l6gi2h29slvc0%40group.calendar.google.com" class="calendar"><span>Events Calendar</span></a>
-				</div>
-			</div>
-			<div class="clear" style="clear: both"></div>
-		</main>
-	</nav>
-</header>
@@ -0,0 +1,18 @@
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <link rel="shortcut icon" type="image/png" href="/images/favicon.png">
+    <link href='https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900,900italic' rel='stylesheet' type='text/css'>
+    <link rel="stylesheet" href='https://fonts.googleapis.com/css?family=Roboto+Mono' type='text/css'>
+    <link rel="stylesheet" href="/css/styles.css"/>
+    <link rel="stylesheet" href="/css/jquery-ui.min.css">
+    <link rel="stylesheet" href="/css/sweetalert.css">
+    {% if page.deprecated %}<link rel="stylesheet" type="text/css" href="/css/deprecation-warning.css">{% endif %}
+    {% if page.class == "gridPage" %}<link rel="stylesheet" href="/css/gridpage.css">{% endif %}
+    <script src="/js/jquery-2.2.0.min.js"></script>
+    <script src="/js/jquery-ui.min.js"></script>
+    <script src="/js/script.js"></script>
+    <script src="/js/sweetalert.min.js"></script>
+    <script src="/js/bootstrap.min.js"></script>
+    {% seo %}
+</head>
@@ -0,0 +1,69 @@
+<div id="cellophane" onclick="kub.toggleMenu()"></div>
+
+<header>
+    <a href="/" class="logo"></a>
+
+    <div class="nav-buttons" data-auto-burger="primary">
+        <ul class="global-nav">
+            <li><a href="/docs/">Documentation</a></li>
+            <li><a href="http://blog.kubernetes.io/">Blog</a></li>
+            <li><a href="/partners/">Partners</a></li>
+            <li><a href="/community/">Community</a></li>
+            <li><a href="/case-studies/">Case Studies</a></li>
+            <li>
+                <a href="#">
+                    {{page.version}} <span class="ui-icon ui-icon-carat-1-s"></span>
+                </a>
+                <ul>
+                {% for version in page.versions %}
+                  <li><a href="{{ version.url }}">{{ version.version }}</a></li>
+                {% endfor %}
+                </ul>
+              </li>
+            </li>
+        </ul>
+        <!-- <a href="/docs/" class="button" id="viewDocs" data-auto-burger-exclude>View Documentation</a> -->
+        <a href="/docs/tutorials/kubernetes-basics/" class="button" id="tryKubernetes" data-auto-burger-exclude>Try Kubernetes</a>
+        <button id="hamburger" onclick="kub.toggleMenu()" data-auto-burger-exclude><div></div></button>
+    </div>
+
+    <nav id="mainNav">
+        <main data-auto-burger="primary">
+        <div class="nav-box">
+            <h3><a href="/docs/hellonode/">Get Started</a></h3>
+            <p>Ready to get your hands dirty? Build a simple Kubernetes cluster that runs "Hello World" for Node.js.</p>
+        </div>
+        <div class="nav-box">
+            <h3><a href="/docs/">Documentation</a></h3>
+            <p>Learn how to use Kubernetes with the use of walkthroughs, samples, and reference documentation. You can even <a href="/editdocs/" data-auto-burger-exclude>help contribute to the docs</a>!</p>
+        </div>
+        <div class="nav-box">
+            <h3><a href="/community/">Community</a></h3>
+            <p>If you need help, you can connect with other Kubernetes users and the Kubernetes authors, attend community events, and watch video presentations from around the web.</p>
+        </div>
+        <div class="nav-box">
+            <h3><a href="http://blog.kubernetes.io">Blog</a></h3>
+            <p>Read the latest news for Kubernetes and the containers space in general, and get technical how-tos hot off the presses.</p>
+        </div>
+        </main>
+        <main data-auto-burger="primary">
+        <div class="left">
+            <h5 class="github-invite">Interested in hacking on the core Kubernetes code base?</h5>
+            <a href="https://github.com/kubernetes/kubernetes" class="button" data-auto-burger-exclude>View On Github</a>
+        </div>
+
+        <div class="right">
+            <h5 class="github-invite">Explore the community</h5>
+            <div class="social">
+                <a href="https://twitter.com/kubernetesio" class="twitter"><span>Twitter</span></a>
+                <a href="https://github.com/kubernetes/kubernetes" class="github"><span>Github</span></a>
+                <a href="http://slack.k8s.io/" class="slack"><span>Slack</span></a>
+                <a href="http://stackoverflow.com/questions/tagged/kubernetes" class="stack-overflow"><span>Stack Overflow</span></a>
+                <a href="https://groups.google.com/forum/#!forum/kubernetes-users" class="mailing-list"><span>Mailing List</span></a>
+                <a href="https://calendar.google.com/calendar/embed?src=nt2tcnbtbied3l6gi2h29slvc0%40group.calendar.google.com" class="calendar"><span>Events Calendar</span></a>
+            </div>
+        </div>
+        <div class="clear" style="clear: both"></div>
+        </main>
+    </nav>
+</header>
@@ -0,0 +1,433 @@
+;(function () {
+	var partners = [
+		{
+			type: 0,
+			name: 'CoreOS',
+			logo: 'core_os',
+			link: 'https://tectonic.com/',
+			blurb: 'Tectonic is the enterprise-ready Kubernetes product, by CoreOS. It adds key features to allow you to manage, update, and control clusters in production.'
+		},
+		{
+			type: 0,
+			name: 'Deis',
+			logo: 'deis',
+			link: 'https://deis.com',
+			blurb: 'Deis the creators of Helm, Workflow, and Steward, helps developers and operators build, deploy, manage and scale their applications on top of Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'StackPointCloud',
+			logo: 'stackpoint',
+			link: 'https://stackpoint.io',
+			blurb: 'StackPointCloud builds Stackpoint.io, the universal control plane for Kubernetes Anywhere -- compose and build your own infrastructure as easily as a DigitalOcean droplet at any public cloud provider.'
+		},
+		{
+			type: 0,
+			name: 'Sysdig Cloud',
+			logo: 'sys_dig',
+			link: 'https://sysdig.com/blog/monitoring-kubernetes-with-sysdig-cloud/',
+			blurb: 'Container native monitoring with deep support for Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'Puppet',
+			logo: 'puppet',
+			link: 'https://puppet.com/blog/managing-kubernetes-configuration-puppet',
+			blurb: 'The Puppet module for Kubernetes makes it easy to manage Pods, Replication Controllers, Services and more in Kubernetes, and to build domain-specific interfaces to one\'s Kubernetes configuration.'
+		},
+		{
+			type: 0,
+			name: 'Citrix',
+			logo: 'citrix',
+			link: 'http://wercker.com/workflows/partners/kubernetes/',
+			blurb: 'Netscaler CPX gives app developers all the features they need to load balance their microservices and containerized apps with Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'Cockroach Labs',
+			logo: 'cockroach_labs',
+			link: 'https://www.cockroachlabs.com/blog/running-cockroachdb-on-kubernetes/',
+			blurb: 'CockroachDB is a distributed SQL database whose built-in replication and survivability model pair with Kubernetes to truly make data easy.'
+		},
+		{
+			type: 0,
+			name: 'Skippbox',
+			logo: 'skippbox',
+			link: 'http://www.skippbox.com/tag/products/',
+			blurb: 'Creator of Cabin the first mobile application for Kubernetes, and kompose. Skippbox’s solutions distill all the power of k8s in simple easy to use interfaces.'
+		},
+		{
+			type: 0,
+			name: 'Weave Works',
+			logo: 'weave_works',
+			link: ' https://weave.works/kubernetes',
+			blurb: 'Weaveworks enables Developers and Dev/Ops teams to easily connect, deploy, secure, manage, and troubleshoot microservices in Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'Wercker',
+			logo: 'wercker',
+			link: 'http://wercker.com/workflows/partners/kubernetes/',
+			blurb: 'Wercker automates your build, test and deploy pipelines for launching containers and triggering rolling updates on your Kubernetes cluster. '
+		},
+		{
+			type: 0,
+			name: 'Rancher',
+			logo: 'rancher',
+			link: 'http://rancher.com/kubernetes/',
+			blurb: 'Rancher is an open-source, production-ready container management platform that makes it easy to deploy and leverage Kubernetes in the enterprise.'
+		},
+		{
+			type: 0,
+			name: 'Red Hat',
+			logo: 'redhat',
+			link: 'https://www.openshift.com/',
+			blurb: 'Leverage an enterprise Kubernetes platform to orchestrate complex, multi-container apps.'
+		},
+		{
+			type: 0,
+			name: 'Intel',
+			logo: 'intel',
+			link: 'https://tectonic.com/press/intel-coreos-collaborate-on-openstack-with-kubernetes.html',
+			blurb: 'Powering the GIFEE (Google’s Infrastructure for Everyone Else), to run OpenStack deployments on Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'ElasticKube',
+			logo: 'elastickube',
+			link: 'https://www.ctl.io/elastickube-kubernetes/',
+			blurb: 'Self-service container management for Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'Platform9',
+			logo: 'platform9',
+			link: 'https://platform9.com/products/kubernetes/',
+			blurb: 'Platform9 is the open source-as-a-service company that takes all of the goodness of Kubernetes and delivers it as a managed service.'
+		},
+		{
+			type: 0,
+			name: 'Datadog',
+			logo: 'datadog',
+			link: 'http://docs.datadoghq.com/integrations/kubernetes/',
+			blurb: 'Full-stack observability for dynamic infrastructure & applications. Includes precision alerting, analytics and deep Kubernetes integrations. '
+		},
+		{
+			type: 0,
+			name: 'AppFormix',
+			logo: 'appformix',
+			link: 'http://www.appformix.com/solutions/appformix-for-kubernetes/',
+			blurb: 'AppFormix is a cloud infrastructure performance optimization service helping enterprise operators streamline their cloud operations on any Kubernetes cloud. '
+		},
+		{
+			type: 0,
+			name: 'Crunchy',
+			logo: 'crunchy',
+			link: 'http://info.crunchydata.com/blog/advanced-crunchy-containers-for-postgresql',
+			blurb: 'Crunchy PostgreSQL Container Suite is a set of containers for managing PostgreSQL with DBA microservices leveraging Kubernetes and Helm.'
+		},
+		{
+			type: 0,
+			name: 'Aqua',
+			logo: 'aqua',
+			link: 'http://blog.aquasec.com/security-best-practices-for-kubernetes-deployment',
+			blurb: 'Deep, automated security for your containers running on Kubernetes.'
+		},
+		{
+			type: 0,
+			name: 'Canonical',
+			logo: 'canonical',
+			link: 'https://jujucharms.com/canonical-kubernetes/',
+			blurb: 'The Canonical Distribution of Kubernetes enables you to operate Kubernetes clusters on demand on any major public cloud and private	infrastructure.'
+		},
+		{
+			type: 0,
+			name: 'Distelli',
+			logo: 'distelli',
+			link: 'https://www.distelli.com/',
+			blurb: 'Pipelines from your source repositories to your Kubernetes Clusters on any cloud.'
+		},
+		{
+			type: 0,
+			name: 'Nuage networks',
+			logo: 'nuagenetworks',
+			link: 'https://github.com/nuagenetworks/nuage-kubernetes',
+			blurb: 'The Nuage SDN platform provides policy-based networking between Kubernetes Pods and non-Kubernetes environments with visibility and security monitoring.'
+		},
+		{
+			type: 0,
+			name: 'Sematext',
+			logo: 'sematext',
+			link: 'https://sematext.com/kubernetes/',
+			blurb: 'Logging & Monitoring: Automatic collection and processing of Metrics, Events and Logs for auto-discovered pods and Kubernetes nodes.'
+		},
+		{
+			type: 0,
+			name: 'Diamanti',
+			logo: 'diamanti',
+			link: 'https://www.diamanti.com/products/',
+			blurb: 'Diamanti deploys containers with guaranteed performance using Kubernetes in the first hyperconverged appliance purpose built for containerized applications.'
+		},
+		{
+			type: 0,
+			name: 'Apprenda',
+			logo: 'apprenda',
+			link: 'https://apprenda.com/kubernetes-support/',
+			blurb: 'Apprenda creates and supports modern, enterprise-ready application platforms for both cloud native and traditional application workloads.'
+		},
+		{
+			type: 0,
+			name: 'Aporeto',
+			logo: 'aporeto',
+			link: 'https://aporeto.com/trireme',
+			blurb: 'Aporeto makes cloud-native applications secure by default without impacting developer velocity and works at any scale, on any cloud.'
+		},
+		{
+  		type: 0,
+ 			name: 'Giant Swarm',
+ 			logo: 'giant_swarm',
+ 			link: 'https://giantswarm.io',
+ 			blurb: 'Giant Swarm provides fully-managed Kubernetes Clusters in your location of choice, so you can focus on your product.'
+ 		},
+		{
+ 			type: 0,
+ 			name: 'Mirantis',
+ 			logo: 'mirantis',
+ 			link: 'https://content.mirantis.com/Containerizing-OpenStack-on-Kubernetes-Video-Landing-Page.html',
+ 			blurb: 'Mirantis builds and manages private clouds with open source software such as OpenStack, deployed as containers orchestrated by Kubernetes.'
+ 		},
+		{
+ 			type: 0,
+ 			name: 'Kubernetic',
+ 			logo: 'kubernetic',
+ 			link: 'https://kubernetic.com/',
+ 			blurb: 'Kubernetic is a Kubernetes Desktop client that simplifies and democratizes cluster management for DevOps.'
+ 		},
+		{
+			type: 1,
+			name: 'Apprenda',
+			logo: 'apprenda',
+			link: 'https://apprenda.com/kubernetes-support/',
+			blurb: 'Apprenda offers flexible and wide range of support plans for pure play Kubernetes on your choice of infrastructure, cloud provider and operating system.'
+		},
+		{
+			type: 1,
+			name: 'Reactive Ops',
+			logo: 'reactive_ops',
+			link: 'https://www.reactiveops.com/kubernetes/',
+			blurb: 'ReactiveOps has written automation on best practices for infrastructure as code on GCP & AWS using Kubernetes, helping you build and maintain a world-class infrastructure at a fraction of the price of an internal hire.'
+		},
+		{
+			type: 1,
+			name: 'Livewyer',
+			logo: 'livewyer',
+			link: 'https://livewyer.io/services/kubernetes-experts/',
+			blurb: 'Kubernetes experts that on-board applications and empower IT teams to get the most out of containerised technology.'
+		},
+		{
+			type: 1,
+			name: 'Deis',
+			logo: 'deis',
+			link: 'https://deis.com/services/',
+			blurb: 'Deis provides professional services and 24x7 operational support for any Kubernetes cluster managed by our global cluster operations team.'
+		},
+		{
+			type: 1,
+			name: 'StackPointCloud',
+			logo: 'stackpoint',
+			link: 'https://stackpoint.io',
+			blurb: 'StackPointCloud offers a wide range of support plans for managed Kubernetes clusters built through its universal control plane for Kubernetes Anywhere.'
+		},
+		{
+			type: 1,
+			name: 'Samsung SDS',
+			logo: 'samsung_sds',
+			link: 'http://www.samsungsdsa.com/cloud-infrastructure_kubernetes',
+			blurb: 'Samsung SDS’s Cloud Native Computing Team offers expert consulting across the range of technical aspects involved in building services targeted at a Kubernetes cluster.'
+		},
+		{
+			type: 1,
+			name: 'Container Solutions',
+			logo: 'container_solutions',
+			link: 'http://container-solutions.com/resources/kubernetes/',
+			blurb: 'Container Solutions is a premium software consultancy that focuses on programmable infrastructure, offering our expertise in software development, strategy and operations to help you innovate at speed and scale.'
+		},
+		{
+			type: 1,
+			name: 'Jetstack',
+			logo: 'jetstack',
+			link: 'https://www.jetstack.io/',
+			blurb: 'Jetstack is an organisation focused entirely on Kubernetes. They will help you to get the most out of Kubernetes through expert professional services and open source tooling. Get in touch, and accelerate your project.'
+		},
+		{
+			type: 0,
+			name: 'Tigera',
+			logo: 'tigera',
+			link: 'http://docs.projectcalico.org/v1.5/getting-started/kubernetes/',
+			blurb: 'Tigera builds high performance, policy driven, cloud native networking solutions for Kubernetes.'
+		},
+		{
+			type: 1,
+			name: 'Skippbox',
+			logo: 'skippbox',
+			link: 'http://www.skippbox.com/services/',
+			blurb: 'Skippbox brings its Kubernetes expertise to help companies embrace Kubernetes on their way to digital transformation. Skippbox offers both professional services and expert training.'
+		},
+		{
+ 			type: 1,
+ 			name: 'Harbur',
+ 			logo: 'harbur',
+ 			link: 'https://harbur.io/',
+ 			blurb: 'Based in Barcelona, Harbur is a consulting firm that helps companies deploy self-healing solutions empowered by Container technologies'
+  		},
+		{
+ 			type: 1,
+ 			name: 'Endocode',
+ 			logo: 'endocode',
+ 			link: 'https://endocode.com/kubernetes/',
+ 			blurb: 'Endocode practices and teaches the open source way. Kernel to cluster - Dev to Ops. We offer Kubernetes trainings, services and support.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'Spotinst',
+ 			logo: 'spotinst',
+ 			link: 'http://blog.spotinst.com/2016/08/04/elastigroup-kubernetes-minions-steroids/',
+ 			blurb: 'Spotinst uses a prediction algorithm in the Amazon EC2 Spot allowing k8s clusters to increase performance and lower the infrastructure costs'
+  		},
+		{
+ 			type: 1,
+ 			name: 'inwinSTACK',
+ 			logo: 'inwinstack',
+ 			link: 'http://www.inwinstack.com/index.php/en/solutions-en/',
+ 			blurb: 'Our container service leverages OpenStack-based infrastructure and its container orchestration engine Magnum to manage Kubernetes clusters.'
+  		},
+		{
+ 			type: 1,
+ 			name: 'Semantix',
+ 			logo: 'semantix',
+ 			link: 'http://www.semantix.com.br/',
+ 			blurb: 'Semantix is a company that works with data analytics and distributed systems. Kubernetes is used to orchestrate services for our customers.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'ASM Technologies Limited',
+ 			logo: 'asm',
+ 			link: 'http://www.asmtech.com/',
+ 			blurb: 'Our technology supply chain portfolio enables your software products to be accessible, viable and available more effectively.'
+  		},
+		{
+ 			type: 1,
+ 			name: 'InfraCloud Technologies',
+ 			logo: 'infracloud',
+ 			link: 'http://blog.infracloud.io/state-of-kubernetes/',
+ 			blurb: 'InfraCloud Technologies is software consultancy which provides services in Containers, Cloud and DevOps.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'SignalFx',
+ 			logo: 'signalfx',
+ 			link: 'https://github.com/signalfx/integrations/tree/master/kubernetes',
+ 			blurb: 'Gain real-time visibility across metrics & the most intelligent alerts for todays architectures, including deep integration with Kubernetes'
+  		},
+		{
+ 			type: 0,
+ 			name: 'NATS',
+ 			logo: 'nats',
+ 			link: 'https://github.com/pires/kubernetes-nats-cluster',
+ 			blurb: 'NATS is a simple, secure, and scalable cloud native messaging system.'
+  		},
+		{
+ 			type: 1,
+ 			name: 'RX-M',
+ 			logo: 'rxm',
+ 			link: 'http://rx-m.com/training/kubernetes-training/',
+ 			blurb: 'Market neutral Kubernetes Dev, DevOps and Production training and consulting services'
+  		},
+		{
+ 			type: 1,
+ 			name: 'Emerging Technology Advisors',
+ 			logo: 'eta',
+ 			link: 'https://www.emergingtechnologyadvisors.com/services/kubernetes.html',
+ 			blurb: 'ETA helps companies architect, implement, and manage scalable applications using Kubernetes on on public or private cloud.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'CloudPlex.io',
+ 			logo: 'cloudplex',
+ 			link: 'http://www.cloudplex.io',
+ 			blurb: 'CloudPlex enables operations teams to visually deploy, orchestrate, manage, and monitor infrastructure, applications, and services in public or private cloud.'
+  		},
+		{
+ 			type: 1,
+ 			name: 'Kumina',
+ 			logo: 'kumina',
+ 			link: 'https://www.kumina.nl/managed_kubernetes',
+ 			blurb: 'Kumina creates Kubernetes solutions on your choice of infrastructure with around-the-clock management and unlimited support.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'CA Technologies',
+ 			logo: 'ca',
+ 			link: 'https://www.ca.com/us/products/application-deployment.html',
+ 			blurb: 'The RA CDE Kubernetes plugin enables an automated process for pushing changes to production by applying standard Kubernetes YAML files'
+  		},
+		{
+ 			type: 0,
+ 			name: 'CoScale',
+ 			logo: 'coscale',
+ 			link: 'http://www.coscale.com/blog/how-to-monitor-your-kubernetes-cluster',
+ 			blurb: 'Full stack monitoring of containers and microservices orchestrated by Kubernetes. Powered by anomaly detection to find problems faster.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'Supergiant.io',
+ 			logo: 'supergiant',
+ 			link: 'https://supergiant.io/blog/supergiant-packing-algorithm-unique-save-money',
+ 			blurb: 'Supergiant autoscales hardware for Kubernetes. Open-source, it makes HA, distributed, stateful apps easy to deploy, manage, and scale.'
+  		},
+		{
+ 			type: 0,
+ 			name: 'Avi Networks',
+ 			logo: 'avinetworks',
+ 			link: 'https://kb.avinetworks.com/avi-vantage-openshift-installation-guide/',
+ 			blurb: 'Avis elastic application services fabric provides scalable, feature rich & integrated L4-7 networking for K8S environments.'
+  		}
+		
+	]
+
+	var isvContainer = document.getElementById('isvContainer')
+	var servContainer = document.getElementById('servContainer')
+
+	var sorted = partners.sort(function (a, b) {
+		if (a.name > b.name) return 1
+		if (a.name < b.name) return -1
+		return 0
+	})
+
+	sorted.forEach(function (obj) {
+		var box = document.createElement('div')
+		box.className = 'partner-box'
+
+		var img = document.createElement('img')
+		img.src = '/images/square-logos/' + obj.logo + '.png'
+
+		var div = document.createElement('div')
+
+		var p = document.createElement('p')
+		p.textContent = obj.blurb
+
+		var link = document.createElement('a')
+		link.href = obj.link
+		link.target = '_blank'
+		link.textContent = 'Learn more'
+
+		div.appendChild(p)
+		div.appendChild(link)
+
+		box.appendChild(img)
+		box.appendChild(div)
+
+		var container = obj.type ? servContainer : isvContainer
+		container.appendChild(box)
+	})
+})();
@@ -0,0 +1,94 @@
+h5 {
+	font-size: 18px;
+	line-height: 1.5em;
+	margin-bottom: 2em;
+}
+
+#usersGrid a {
+	display: inline-block;
+	background-color: #f9f9f9;
+}
+
+#isvContainer, #servContainer {
+	position: relative;
+	width: 100%;
+	display: flex;
+	justify-content: space-between;
+	flex-wrap: wrap;
+}
+
+#isvContainer {
+	margin-bottom: 80px;
+}
+
+.partner-box {
+	position: relative;
+	width: 47%;
+	max-width: 48%;
+	min-width: 48%;
+	margin-bottom: 20px;
+	padding: 20px;
+	flex: 1;
+	display: flex;
+	justify-content: space-between;
+	align-items: flex-start;
+}
+
+.partner-box img {
+	background-color: #f9f9f9;
+}
+
+.partner-box > div {
+	margin-left: 30px;
+}
+
+.partner-box a {
+	color: #3576E3;
+}
+
+@media screen and (max-width: 1024px) {
+	.partner-box {
+		flex-direction: column;
+		justify-content: flex-start;
+	}
+
+	.partner-box > div {
+		margin: 20px 0 0;
+	}
+}
+
+@media screen and (max-width: 568px) {
+	#isvContainer, #servContainer {
+		justify-content: center;
+	}
+
+	.partner-box {
+		flex-direction: column;
+		justify-content: flex-start;
+		width: 100%;
+		max-width: 100%;
+		min-width: 100%;
+	}
+
+	.partner-box > div {
+		margin: 20px 0 0;
+	}
+}
+
+@media screen and (max-width: 568px) {
+	#isvContainer, #servContainer {
+		justify-content: center;
+	}
+
+	.partner-box {
+		flex-direction: column;
+		justify-content: flex-start;
+		width: 100%;
+		max-width: 100%;
+		min-width: 100%;
+	}
+
+	.partner-box > div {
+		margin: 20px 0 0;
+	}
+}
@@ -0,0 +1,4 @@
+You need to have a Kubernetes cluster, and the kubectl command-line tool must
+be configured to communicate with your cluster. If you do not already have a
+cluster, you can create one by using
+[Minikube](/docs/getting-started-guides/minikube).
@@ -0,0 +1,32 @@
+{% if overview %}
+
+{{ overview }}
+
+{% else %}
+
+{% include templates/_errorthrower.md missing_block='overview' purpose='provides an overview of this concept.' %}
+
+{% endif %}
+
+* TOC
+{:toc}
+
+{% if body %}
+
+{{ body }}
+
+{% else %}
+
+{% include templates/_errorthrower.md missing_block='body' purpose='supplies the body of the page content.' %}
+
+{% endif %}
+
+
+{% if whatsnext %}
+
+## What's next
+
+{{ whatsnext }}
+
+{% endif %}
+
@@ -1,36 +1,55 @@
-{% if purpose %}
+{% if overview %}

-### Purpose
-
-{{ purpose }}
+{{ overview }}

 {% else %}

-{% include templates/_errorthrower.md missing_block='purpose' heading='Purpose' purpose='states, in one sentence, what the purpose of this document is, so that the user will know what they are able to achieve if they follow the provided steps.' %}
-
-{% endif %}
-
-{% if recommended_background %}
-
-### Recommended background
-
-{{ recommended_background }}
-
-{% else %}
-
-{% include templates/_errorthrower.md missing_block='recommended_background' heading='Recommended background' purpose='lists assumptions of baseline knowledge that you expect the user to have before reading ahead.' %}
+{% include templates/_errorthrower.md missing_block='overview' purpose='states, in one or two sentences, the purpose of this document' %}

 {% endif %}


-{% if step_by_step %}
+* TOC
+{: toc}

-### Step by step

-{{ step_by_step }}
+{% if prerequisites %}
+
+## Before you begin
+
+{{ prerequisites }}

 {% else %}

-{% include templates/_errorthrower.md missing_block='step_by_step' heading='Step by step' purpose='lists a series of linear, numbered steps that accomplish the described task.' %}
+{% include templates/_errorthrower.md missing_block='prerequisites' heading='Before you begin' purpose='lists action prerequisites and knowledge prerequisites' %}

-{% endif %}
+{% endif %}
+
+
+{% if steps %}
+
+{{ steps }}
+
+{% else %}
+
+{% include templates/_errorthrower.md missing_block='steps' purpose='lists a sequence of numbered steps that accomplish the task.' %}
+
+{% endif %}
+
+
+{% if discussion %}
+
+{{ discussion }}
+
+{% else %}
+
+{% endif %}
+
+
+{% if whatsnext %}
+
+## What's next
+
+{{ whatsnext }}
+
+{% endif %}
@@ -0,0 +1,68 @@
+{% if overview %}
+
+{{ overview }}
+
+{% else %}
+
+{% include templates/_errorthrower.md missing_block='overview' purpose='states, in one or two sentences, the purpose of this document' %}
+
+{% endif %}
+
+
+* TOC
+{: toc}
+
+
+{% if objectives %}
+
+## Objectives
+
+{{ objectives }}
+
+{% else %}
+
+{% include templates/_errorthrower.md missing_block='objectives' heading='Objectives' purpose='lists the objectives for this tutorial.' %}
+
+{% endif %}
+
+
+{% if prerequisites %}
+
+## Before you begin
+
+{{ prerequisites }}
+
+{% else %}
+
+{% include templates/_errorthrower.md missing_block='prerequisites' heading='Before you begin' purpose='lists action prerequisites and knowledge prerequisites' %}
+
+{% endif %}
+
+
+{% if lessoncontent %}
+
+{{ lessoncontent }}
+
+{% else %}
+
+{% include templates/_errorthrower.md missing_block='lessoncontent' purpose='provides the lesson content for this tutorial.' %}
+
+{% endif %}
+
+
+{% if cleanup %}
+
+## Cleaning up
+
+{{ cleanup }}
+
+{% endif %}
+
+
+{% if whatsnext %}
+
+## What's next
+
+{{ whatsnext }}
+
+{% endif %}
@@ -1 +1,15 @@
-{% for item in tree %}{% if item.section %}{% assign tree = item.section %}{% include tocsearch.html %}{% else %}{% if item.path == page.url %}{% assign foundTOC = thistoc %}{% assign title = item.title %}{% break %}{% endif %}{% endif %}{% endfor %}
+{% capture whitespace %}
+  {% for item in include.tree %}
+    {% if found_toc %}
+      {% break %}
+    {% endif %}
+    {% if item.section %}
+      {% include tocsearch.html tree=item.section toc=include.toc %}
+    {% else %}
+      {% if item == page.path %}
+        {% assign found_toc = include.toc %}
+        {% break %}
+      {% endif %}
+    {% endif %}
+  {% endfor %}
+{% endcapture %}
@@ -1,6 +1,25 @@
-{% for item in tree %}{% if item.section %}
-<div class="item" data-title="{{ item.title }}">
-  <div class="container">{% assign tree = item.section %}{% include tree.html %}
-  </div>
-</div>{% else %}{% assign prefix = item.path | slice: 0, 4 %}{% if prefix == "http" %}{% assign target=" target='_blank'" %}{% else %}{% assign target="" %}{% endif %}
-    <a class="item" data-title="{{ item.title }}" href="{{ item.path }}"{{ target }}></a>{% endif %}{% endfor %}
+{% for item in include.tree %}
+  {% if item.section %}
+    <div class="item" data-title="{{ item.title }}">
+      <div class="container">
+        {% include_cached tree.html tree=item.section %}
+      </div>
+    </div>
+  {% else %}
+
+    {% capture whitespace %}
+      {% if item.path %}
+        {% assign path   = item.path %}
+        {% assign title  = item.title %}
+      {% else %}
+        {% assign found_page = site.pages | where: "path", item | first %}
+        {% assign title = found_page.title %}
+        {% assign path  = found_page.url %}
+      {% endif %}
+    {% endcapture %}
+
+    {% if path %}
+      <a class="item" data-title="{{ title }}" href="{{ path }}"></a>
+    {% endif %}
+  {% endif %}
+{% endfor %}
@@ -0,0 +1,3 @@
+The topics in the [User Guide](/docs/user-guide/) section of the Kubernetes docs
+are being moved to the [Tasks](/docs/tasks/), [Tutorials](/docs/tutorials/), and
+[Concepts](/docs/concepts) sections. The content in this topic has moved to:
@@ -0,0 +1,12 @@
+
+
+<table style="background-color:#eeeeee">
+<tr>
+  <td>
+  <p><b>NOTICE</b></p>
+  <p>As of March 14, 2017, the Kubernetes SIG-Docs-Maintainers group have begun migration of the User Guide content as announced previously to the <a href="https://git.k8s.io/community/sig-docs">SIG Docs community</a> through the <a href="https://groups.google.com/forum/#!forum/kubernetes-sig-docs">kubernetes-sig-docs</a> group and <a href="https://kubernetes.slack.com/messages/sig-docs/">kubernetes.slack.com #sig-docs</a> channel.</p>
+  <p>The user guides within this section are being refactored into topics within Tutorials, Tasks, and Concepts. Anything that has been moved will have a notice placed in its previous location as well as a link to its new location. The reorganization implements a new table of contents and should improve the documentation's findability and readability for a wider range of audiences.</p>
+  <p>For any questions, please contact: <a href="mailto:kubernetes-sig-docs@googlegroups.com">kubernetes-sig-docs@googlegroups.com</a></p>
+  </td>
+</tr>
+</table>
@@ -2079,7 +2079,7 @@ Populated by the system when a graceful deletion is requested. Read-only. More i
 <div class="sect2">
 <h3 id="_v1_flexvolumesource">v1.FlexVolumeSource</h3>
 <div class="paragraph">
-<p>FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p>
+<p>FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p>
 </div>
 <table class="tableblock frame-all grid-all" style="width:100%; ">
 <colgroup>
@@ -2535,7 +2535,7 @@ Populated by the system when a graceful deletion is requested. Read-only. More i
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">flexVolume</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_flexvolumesource">v1.FlexVolumeSource</a></p></td>
 <td class="tableblock halign-left valign-top"></td>
@@ -4275,10 +4275,10 @@ Populated by the system when a graceful deletion is requested. Read-only. More i
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">host</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">Host is the fully qualified domain name of a network host, as defined by RFC 3986. Note the following deviations from the "host" part of the URI as defined in the RFC: 1. IPs are not allowed. Currently an IngressRuleValue can only apply to the<br>
-	  IP in the Spec of the parent Ingress.<br>
+      IP in the Spec of the parent Ingress.<br>
 2. The <code>:</code> delimiter is not respected because ports are not allowed.<br>
-	  Currently the port of an Ingress is implicitly :80 for http and<br>
-	  :443 for https.<br>
+      Currently the port of an Ingress is implicitly :80 for http and<br>
+      :443 for https.<br>
 Both these may change in the future. Incoming requests are matched against the host before the IngressRuleValue. If the host is unspecified, the Ingress routes all traffic based on the specified IngressRuleValue.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
@@ -5867,7 +5867,7 @@ Both these may change in the future. Incoming requests are matched against the h
 <tbody>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">path</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Path is a extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Path is an extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
@@ -5578,7 +5578,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_a_ingress">create a Ingress</h3>
+<h3 id="_create_a_ingress">create an Ingress</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /apis/extensions/v1beta1/namespaces/{namespace}/ingresses</pre>
@@ -5959,7 +5959,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_delete_a_ingress">delete a Ingress</h3>
+<h3 id="_delete_a_ingress">delete an Ingress</h3>
 <div class="listingblock">
 <div class="content">
 <pre>DELETE /apis/extensions/v1beta1/namespaces/{namespace}/ingresses/{name}</pre>
@@ -2560,7 +2560,7 @@ The resulting set of endpoints can be viewed as:<br>
 <div class="sect2">
 <h3 id="_v1_flexvolumesource">v1.FlexVolumeSource</h3>
 <div class="paragraph">
-<p>FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p>
+<p>FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p>
 </div>
 <table class="tableblock frame-all grid-all" style="width:100%; ">
 <colgroup>
@@ -3268,7 +3268,7 @@ The resulting set of endpoints can be viewed as:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">flexVolume</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_flexvolumesource">v1.FlexVolumeSource</a></p></td>
 <td class="tableblock halign-left valign-top"></td>
@@ -5555,7 +5555,7 @@ The resulting set of endpoints can be viewed as:<br>
 </tr>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">flexVolume</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using a exec based plugin. This is an alpha feature and may change in future.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin. This is an alpha feature and may change in future.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_flexvolumesource">v1.FlexVolumeSource</a></p></td>
 <td class="tableblock halign-left valign-top"></td>
@@ -2676,7 +2676,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_a_endpoints">create a Endpoints</h3>
+<h3 id="_create_a_endpoints">create an Endpoints</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /api/v1/namespaces/{namespace}/endpoints</pre>
@@ -3057,7 +3057,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_delete_a_endpoints">delete a Endpoints</h3>
+<h3 id="_delete_a_endpoints">delete an Endpoints</h3>
 <div class="listingblock">
 <div class="content">
 <pre>DELETE /api/v1/namespaces/{namespace}/endpoints/{name}</pre>
@@ -3619,7 +3619,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_a_event">create a Event</h3>
+<h3 id="_create_a_event">create an Event</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /api/v1/namespaces/{namespace}/events</pre>
@@ -4000,7 +4000,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_delete_a_event">delete a Event</h3>
+<h3 id="_delete_a_event">delete an Event</h3>
 <div class="listingblock">
 <div class="content">
 <pre>DELETE /api/v1/namespaces/{namespace}/events/{name}</pre>
@@ -69,12 +69,6 @@
 <li>
 <p><a href="#_v1beta1_networkpolicylist">v1beta1.NetworkPolicyList</a></p>
 </li>
-<li>
-<p><a href="#_v1beta1_storageclass">v1beta1.StorageClass</a></p>
-</li>
-<li>
-<p><a href="#_v1beta1_storageclasslist">v1beta1.StorageClassList</a></p>
-</li>
 </ul>
 </div>
 </div>
@@ -1213,71 +1207,6 @@ Examples:<br>
 </tbody>
 </table>

-</div>
-<div class="sect2">
-<h3 id="_v1beta1_storageclass">v1beta1.StorageClass</h3>
-<div class="paragraph">
-<p>StorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned.</p>
-</div>
-<div class="paragraph">
-<p>StorageClasses are non-namespaced; the name of the storage class according to etcd is in ObjectMeta.Name.</p>
-</div>
-<table class="tableblock frame-all grid-all" style="width:100%; ">
-<colgroup>
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;"> 
-</colgroup>
-<thead>
-<tr>
-<th class="tableblock halign-left valign-top">Name</th>
-<th class="tableblock halign-left valign-top">Description</th>
-<th class="tableblock halign-left valign-top">Required</th>
-<th class="tableblock halign-left valign-top">Schema</th>
-<th class="tableblock halign-left valign-top">Default</th>
-</tr>
-</thead>
-<tbody>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">kind</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#types-kinds">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#types-kinds</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">apiVersion</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#resources">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#resources</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">metadata</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Standard object&#8217;s metadata. More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#metadata">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#metadata</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_objectmeta">v1.ObjectMeta</a></p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">provisioner</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Provisioner indicates the type of the provisioner.</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">parameters</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Parameters holds the parameters for the provisioner that should create volumes of this storage class.</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-</tbody>
-</table>
-
 </div>
 <div class="sect2">
 <h3 id="_v1_execaction">v1.ExecAction</h3>
@@ -1859,61 +1788,6 @@ Populated by the system when a graceful deletion is requested. Read-only. More i
 <div class="paragraph">
 <p>Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.</p>
 </div>
-</div>
-<div class="sect2">
-<h3 id="_v1beta1_storageclasslist">v1beta1.StorageClassList</h3>
-<div class="paragraph">
-<p>StorageClassList is a collection of storage classes.</p>
-</div>
-<table class="tableblock frame-all grid-all" style="width:100%; ">
-<colgroup>
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;">
-<col style="width:20%;"> 
-</colgroup>
-<thead>
-<tr>
-<th class="tableblock halign-left valign-top">Name</th>
-<th class="tableblock halign-left valign-top">Description</th>
-<th class="tableblock halign-left valign-top">Required</th>
-<th class="tableblock halign-left valign-top">Schema</th>
-<th class="tableblock halign-left valign-top">Default</th>
-</tr>
-</thead>
-<tbody>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">kind</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#types-kinds">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#types-kinds</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">apiVersion</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#resources">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#resources</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">metadata</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Standard list metadata More info: <a href="http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#metadata">http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#metadata</a></p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_unversioned_listmeta">unversioned.ListMeta</a></p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-<tr>
-<td class="tableblock halign-left valign-top"><p class="tableblock">items</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Items is the list of StorageClasses</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1beta1_storageclass">v1beta1.StorageClass</a> array</p></td>
-<td class="tableblock halign-left valign-top"></td>
-</tr>
-</tbody>
-</table>
-
 </div>
 <div class="sect2">
 <h3 id="_v1_flockervolumesource">v1.FlockerVolumeSource</h3>
@@ -4519,10 +4393,10 @@ Populated by the system when a graceful deletion is requested. Read-only. More i
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">host</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">Host is the fully qualified domain name of a network host, as defined by RFC 3986. Note the following deviations from the "host" part of the URI as defined in the RFC: 1. IPs are not allowed. Currently an IngressRuleValue can only apply to the<br>
-	  IP in the Spec of the parent Ingress.<br>
+      IP in the Spec of the parent Ingress.<br>
 2. The <code>:</code> delimiter is not respected because ports are not allowed.<br>
-	  Currently the port of an Ingress is implicitly :80 for http and<br>
-	  :443 for https.<br>
+      Currently the port of an Ingress is implicitly :80 for http and<br>
+      :443 for https.<br>
 Both these may change in the future. Incoming requests are matched against the host before the IngressRuleValue. If the host is unspecified, the Ingress routes all traffic based on the specified IngressRuleValue.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
@@ -6180,7 +6054,7 @@ Both these may change in the future. Incoming requests are matched against the h
 <tbody>
 <tr>
 <td class="tableblock halign-left valign-top"><p class="tableblock">path</p></td>
-<td class="tableblock halign-left valign-top"><p class="tableblock">Path is an extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Path is an extended POSIX regex as defined by IEEE Std 1003.1, (i.e. this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a <em>/</em>. If unspecified, the path defaults to a catch all sending traffic to the backend.</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
 <td class="tableblock halign-left valign-top"></td>
@@ -6328,7 +6202,7 @@ Both these may change in the future. Incoming requests are matched against the h
 </div>
 <div id="footer">
 <div id="footer-text">
-Last updated 2016-09-01 21:16:11 UTC
+Last updated 2016-09-09 01:13:48 UTC
 </div>
 </div>
 </body>
@@ -6391,7 +6391,7 @@ The resulting set of endpoints can be viewed as:<br>
 <div class="sect2">
 <h3 id="_v1alpha1_eviction">v1alpha1.Eviction</h3>
 <div class="paragraph">
-<p>Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod.  A request to cause such an eviction is created by POSTing to &#8230;/pods/foo/evictions.</p>
+<p>Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod.  A request to cause such an eviction is created by POSTing to &#8230;/pods/&lt;pod name&gt;/evictions.</p>
 </div>
 <table class="tableblock frame-all grid-all" style="width:100%; ">
 <colgroup>
@@ -2676,7 +2676,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_a_endpoints">create a Endpoints</h3>
+<h3 id="_create_a_endpoints">create an Endpoints</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /api/v1/namespaces/{namespace}/endpoints</pre>
@@ -3057,7 +3057,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_delete_a_endpoints">delete a Endpoints</h3>
+<h3 id="_delete_a_endpoints">delete an Endpoints</h3>
 <div class="listingblock">
 <div class="content">
 <pre>DELETE /api/v1/namespaces/{namespace}/endpoints/{name}</pre>
@@ -3619,7 +3619,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_a_event">create a Event</h3>
+<h3 id="_create_a_event">create an Event</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /api/v1/namespaces/{namespace}/events</pre>
@@ -4000,7 +4000,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_delete_a_event">delete a Event</h3>
+<h3 id="_delete_a_event">delete an Event</h3>
 <div class="listingblock">
 <div class="content">
 <pre>DELETE /api/v1/namespaces/{namespace}/events/{name}</pre>
@@ -7885,7 +7885,7 @@
 </div>
 </div>
 <div class="sect2">
-<h3 id="_create_eviction_of_a_eviction">create eviction of a Eviction</h3>
+<h3 id="_create_eviction_of_a_eviction">create eviction of an Eviction</h3>
 <div class="listingblock">
 <div class="content">
 <pre>POST /api/v1/namespaces/{namespace}/pods/{name}/eviction</pre>
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html id="{{ page.cid }}" lang="en" class="{{ page.class }}">
+
+    {% include head.html %}
+
+    <body>
+        {% include header.html %}
+
+        {{ content }}
+
+        {% include footer.html %}
+
+        {% include footer-scripts.html %}
+    </body>
+</html>
@@ -1,83 +1,84 @@
-{% for thistoc in site.data.globals.tocs %}{% if foundTOC %}{% break %}{% else %}{% assign tree = site.data[thistoc].toc %}{% include tocsearch.html %}{% endif %}{% endfor %}
-{% for override in site.data.overrides.overrides %}{% if page.path contains override.path %}{% assign notitle = "true" %}{% endif %}{% endfor %}
-<!Doctype html>
-<html id="docs" class="{{site.data[foundTOC].bigheader}}">
+{% for current_toc in site.tocs %}
+  {% if found_toc %}
+    {% break %}
+  {% else %}
+    {% assign toc=site.data[current_toc] %}
+    {% include tocsearch.html tree=toc.toc toc=toc %}
+  {% endif %}
+{% endfor %}

-{% include head-header.html %}
+<!Doctype html>
+<html id="docs" class="{{ toc.bigheader }}">
+
+{% include head.html %}
+
+<body>
+
+{% include header.html %}

 <!--  HERO  -->
 <section id="hero" class="light-text">
-	<h1>{{ site.data[foundTOC].bigheader }}</h1>
-	<h5>{{ site.data[foundTOC].abstract }}</h5>
-	<div id="vendorStrip" class="light-text">
-		<ul>
-			<li><a href="/docs/" {% if site.data[foundTOC].bigheader == "Guides" %}class="YAH"{% endif %}>GUIDES</a></li>
-			<li><a href="/docs/reference" {% if site.data[foundTOC].bigheader == "Reference Documentation" %}class="YAH"{% endif %}>REFERENCE</a></li>
-			<li><a href="/docs/samples" {% if site.data[foundTOC].bigheader == "Samples" %}class="YAH"{% endif %}>SAMPLES</a></li>
-			<li><a href="/docs/troubleshooting/" {% if site.data[foundTOC].bigheader == "Support" %}class="YAH"{% endif %}>SUPPORT</a></li>
-		</ul>
-		<div id="searchBox">
-			<input type="text" id="search" placeholder="Search" onkeydown="if (event.keyCode==13) window.location.replace('/docs/search/?q=' + this.value)">
-		</div>
-	</div>
+  <h1>{{ toc.bigheader }}</h1>
+  <h5>{{ toc.abstract }}</h5>
+  <div id="vendorStrip" class="light-text">
+    <ul>
+      <li><a href="/docs/" {% if toc.bigheader == "Kubernetes Documentation" %}class="YAH"{% endif %}>DOCS HOME</a></li>
+      <li><a href="/docs/user-guide/" {% if toc.bigheader == "Guides" %}class="YAH"{% endif %}>GUIDES</a></li>
+      <li><a href="/docs/tutorials/" {% if toc.bigheader == "Tutorials" %}class="YAH"{% endif %}>TUTORIALS</a></li>
+      <li><a href="/docs/tasks/" {% if toc.bigheader == "Tasks" %}class="YAH"{% endif %}>TASKS</a></li>
+      <li><a href="/docs/concepts/" {% if toc.bigheader == "Concepts" %}class="YAH"{% endif %}>CONCEPTS</a></li>
+      <li><a href="/docs/reference/" {% if toc.bigheader == "Reference Documentation" %}class="YAH"{% endif %}>REFERENCE</a></li>
+      <li><a href="/docs/tools/" {% if toc.bigheader == "Tools" %}class="YAH"{% endif %}>TOOLS</a></li>
+      <li><a href="/docs/samples/" {% if toc.bigheader == "Samples" %}class="YAH"{% endif %}>SAMPLES</a></li>
+      <li><a href="/docs/troubleshooting/" {% if toc.bigheader == "Support" %}class="YAH"{% endif %}>SUPPORT</a></li>
+    </ul>
+    <div id="searchBox">
+      <input type="text" id="search" placeholder="Search" onkeydown="if (event.keyCode==13) window.location.replace('/docs/search/?q=' + this.value)" autofocus="autofocus">
+    </div>
+  </div>
 </section>

+{% include deprecation-warning.html %}
+
 <section id="encyclopedia">
-	<div id="docsToc">
+  <div id="docsToc">
        <div class="pi-accordion">
-        {% assign tree = site.data[foundTOC].toc %}{% include tree.html %}
+        {% if toc.bigheader != "Kubernetes Documentation" %}
+          {% include_cached tree.html tree=toc.toc %}
+        {% endif %}
        </div> <!-- /pi-accordion -->
-		<button class="push-menu-close-button" onclick="kub.toggleToc()"></button>
-	</div> <!-- /docsToc -->
-	<div id="docsContent">
+    <button class="push-menu-close-button" onclick="kub.toggleToc()"></button>
+  </div> <!-- /docsToc -->
+
+  <div id="docsContent">
        <p><a href="/editdocs#{{ page.path }}" id="editPageButton">Edit This Page</a></p>
-    	{% if notitle != "true" %}<h1>{{ title }}</h1>{% endif %}
-		{{ content }}
-        <p><a href=""><img src="https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/{{ page.path }}?pixel" alt="Analytics" /></a>
-        {% if page.url != "/404.html" && page.url != "/docs/search/" %}<div id="pd_rating_holder_8345992"></div>
-		<script type="text/javascript">
-	        PDRTJS_settings_8345992 = {
-		        "id" : "8345992",
-		        "unique_id" : "{{page.url}}",
-		        "title" : "{{title}}",
-		        "permalink" : "http://kubernetes.github.io{{page.url}}"
-	        };
-	        (function(d,c,j){if(!document.getElementById(j)){var pd=d.createElement(c),s;pd.id=j;pd.src=('https:'==document.location.protocol)?'https://polldaddy.com/js/rating/rating.js':'http://i0.poll.fm/js/rating/rating.js';s=document.getElementsByTagName(c)[0];s.parentNode.insertBefore(pd,s);}}(document,'script','pd-rating-js'));
-		</script>
-		<a href="" onclick="window.open('https://github.com/kubernetes/kubernetes.github.io/issues/new?title=Issue%20with%20' +
-		window.location.pathname + '&body=Issue%20with%20' +
-		window.location.pathname)" class="button issue">Create Issue</a>
-		<a href="/editdocs#{{ page.path }}" class="button issue">Edit This Page</a>
-	{% endif %}
-	</div>
+
+        {% unless page.notitle %}
+          <h1>{{ page.title }}</h1>
+        {% endunless %}
+
+        {{ content }}
+
+        <p><a href=""><img src="https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/{{ page.path }}?pixel" alt="Analytics" /></a></p>
+        {% if page.url != "/404.html" and page.url != "/docs/search/" %}
+        <script type="text/javascript">
+            PDRTJS_settings_8345992 = {
+                "id" : "8345992",
+                "unique_id" : "{{ page.url }}",
+                "title" : "{{ page.title }}",
+                "permalink" : "http://kubernetes.github.io{{ page.url }}"
+            };
+            (function(d,c,j){if(!document.getElementById(j)){var pd=d.createElement(c),s;pd.id=j;pd.src=('https:'==document.location.protocol)?'https://polldaddy.com/js/rating/rating.js':'http://i0.poll.fm/js/rating/rating.js';s=document.getElementsByTagName(c)[0];s.parentNode.insertBefore(pd,s);}}(document,'script','pd-rating-js'));
+        </script>
+        <a href="" onclick="window.open('https://github.com/kubernetes/kubernetes.github.io/issues/new?title=Issue%20with%20' +
+        window.location.pathname)" class="button issue">Create an Issue</a>
+        <a href="/editdocs#{{ page.path }}" class="button issue">Edit this Page</a>
+    {% endif %}
+    </div>
 </section>

-{% include footer.html %}
+{% include_cached footer.html %}
+{% include footer-scripts.html %}

-<button class="flyout-button" onclick="kub.toggleToc()"></button>
-
-<style>
-	.cse .gsc-control-cse, .gsc-control-cse, {
-		padding: 0;
-	}
-	.gsc-control-cse table, .gsc-control-cse-en table {
-		margin:0px !important;
-	}
-
-	.gsc-above-wrapper-area {
-		border-bottom: 0;
-	}
-</style>
-<script>
-  (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
-  (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
-  m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
-  })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
-
-  ga('create', 'UA-36037335-10', 'auto');
-  ga('send', 'pageview');
-</script>
-<!-- Commenting out AnswerDash for now; we need to work on our list of questions/answers/design first
-<!-- Start of AnswerDash script <script>var AnswerDash;!function(e,t,n,s,a){if(!t.getElementById(s)){var i,r=t.createElement(n),c=t.getElementsByTagName(n)[0];e[a]||(i=e[a]=function(){i.__oninit.push(arguments)},i.__oninit=[]),r.type="text/javascript",r.async=!0,r.src="https://p1.answerdash.com/answerdash.min.js?siteid=756",r.setAttribute("id",s),c.parentNode.insertBefore(r,c)}}(window,document,"script","answerdash-script","AnswerDash");</script> <!-- End of AnswerDash script -->
 </body>
 </html>
@@ -234,6 +234,74 @@ header
 			color: $blue
 			text-decoration: none

+// Global Nav - 12/9/2016 Update
+
+ul.global-nav
+	display: none
+
+	li
+		display: inline-block
+		margin-right: 14px
+
+		a
+			color: #fff
+			font-weight: 400
+			padding: 0
+			position: relative
+
+			&.active:after
+				position: absolute
+				width: 100%
+				height: 2px
+				content: ''
+				bottom: -4px
+				left: 0
+				background: #fff
+
+			.ui-icon
+				filter: brightness(0) invert(1)
+
+		ul
+			display: none
+			position: fixed
+			top: 40px
+			text-align: left
+
+			li
+				display: block
+				height: 28px
+
+				a
+					background: $dark-grey
+					color: #fff
+					padding: 7px
+
+			li:last-child
+				a
+					border-radius: 7px
+
+	li:hover
+		ul
+			display: block
+
+
+.flip-nav ul.global-nav li a,
+.open-nav ul.global-nav li a,
+	color: $dark-grey
+
+.flip-nav ul.global-nav li a .ui-icon
+	filter: brightness(0)
+
+.flip-nav ul.global-nav li ul li a,
+	background: #fff
+	color: $dark-grey
+
+.flip-nav ul.global-nav li a.active:after,
+.flip-nav ul.global-nav li ul li a.active:after,
+.open-nav ul.global-nav li a.active:after,
+
+	background: $blue
+
 // FLIP NAV
 .flip-nav
 	header
@@ -301,6 +369,26 @@ header
 	padding-left: 0
 	padding-right: 0
 	margin-bottom: 0
+	position: relative
+
+	&.bot-bar:after
+		display: block
+		margin-bottom: -20px
+		height: 8px
+		width: 100%
+		background-color: transparentize(white, 0.9)
+		content: ''
+	
+	&.no-sub
+		
+		h5
+			display: none
+		
+		h1
+			margin-bottom: 20px
+
+#home #hero:after
+	display: none

 // VENDOR STRIP
 #vendorStrip
@@ -389,6 +477,14 @@ footer
 		display: block
 		height: 0
 		overflow: hidden
+		
+	&.button
+		background-image: none
+		width: auto
+		height: auto
+		
+		&:hover
+			color: $blue

 a.twitter
 	background-position: 0 0
@@ -474,6 +570,19 @@ section
 			margin: 0 auto
 			height: 44px
 			line-height: 44px
+			position: relative
+			
+			&:before
+				position: absolute
+				width: 15px
+				height: 15px
+				content: ''
+				right: 8px
+				top: 7px
+				background-image: url(/images/search-icon.svg)
+				background-repeat: no-repeat
+				background-size: 100% 100%
+				z-index: 1

 		#search
 			width: 100%
@@ -482,6 +591,10 @@ section
 			line-height: 30px
 			font-size: 16px
 			vertical-align: top
+			background: #fff
+			border: none
+			border-radius: 4px
+			position: relative


 #encyclopedia
@@ -704,7 +817,6 @@ dd
 		font-weight: 500
 		margin-bottom: 30px
 		padding-bottom: 10px
-		border-bottom: 1px solid #cccccc

 		// Make sure anchor links aren't hidden by the header
 		&:before
@@ -714,6 +826,9 @@ dd
 			height: $header-clearance
 			visibility: hidden

+	h1,h2
+		border-bottom: 1px solid #cccccc
+		
 	h1
 		font-size: 32px
 		padding-right: 60px
@@ -723,18 +838,21 @@ dd

 	h3
 		font-size: 24px
+		font-weight: 300
+		margin-bottom: 5px

 	h4
 		font-size: 20px
+		margin-bottom: 0px

 	h5, h6
 		font-size: 16px
 		font-weight: 500

 	p
-		font-size: 14px
+		font-size: 16px
 		font-weight: 300
-		line-height: 1.25em
+		line-height: 1.75em

 	p + p
 		margin-top: 10px
@@ -745,7 +863,7 @@ dd
 		background-color: $light-grey
 		color: $dark-grey
 		font-family: $mono-font
-		vertical-align: bottom
+		vertical-align: baseline
 		font-size: 14px
 		font-weight: bold
 		padding: 2px 4px
@@ -772,6 +890,7 @@ dd
 		display: block
 		margin: 20px 0
 		padding: 15px
+		position: relative
 		overflow-x: auto

 	h1 code, h2 code, h3 code, h4 code, h5 code, h6 code
@@ -779,6 +898,9 @@ dd
 		font-size: inherit
 		background-color: transparent

+	.includecode
+		table-layout: fixed
+
 	.includecode, .includecode th, .includecode td
 		padding: 0 !important

@@ -809,6 +931,8 @@ dd

 	li
 		margin-bottom: 0.75em
+		font-size: 16px
+		line-height: 1.75em

 	table
 		width: 100%
@@ -874,11 +998,22 @@ dd
 	img
 		max-width: 100%

+	a
+		//font-weight: 700
+		text-decoration: underline
+
+//  a:visited
+//      color: blueviolet
+
 	a.button
 		border-radius: 2px
+		text-decoration: none
+		
+		&:visited
+			color: white

 	a.issue
-		margin-left: 20px
+		margin-left: 0px

 .fixed footer
 	position: fixed
@@ -989,7 +1124,7 @@ $feature-box-div-margin-bottom: 40px
 #video
 	width: 100%
 	position: relative
-	background-image: url(/images/kub_video_thm.jpg)
+	background-image: url(/images/kub_video_banner.jpg)
 	background-position: center center
 	background-size: cover

@@ -1131,7 +1266,7 @@ $feature-box-div-margin-bottom: 40px

 // Community

-#community
+#community, .gridPage
 	&.open-nav, &.flip-nav
 		.logo
 			background-image: url(/images/nav_logo2.svg)
@@ -1182,7 +1317,7 @@ $feature-box-div-margin-bottom: 40px
 				background-color: $white
 				box-shadow: 0 5px 5px rgba(0,0,0,.24),0 0 5px rgba(0,0,0,.12)

-		#calendarWrapper
+		#calendarMeetings
 			position: relative
 			width: 80vw
 			height: 60vw
@@ -1190,12 +1325,284 @@ $feature-box-div-margin-bottom: 40px
 			max-height: 900px
 			margin: 20px auto

+		#calendarEvents
+			position: relative
+			width: 80vw
+			height: 30vw
+			max-width: 1200px
+			max-height: 450px
+			margin: 20px auto           
+
 		iframe
 			position: absolute
 			border: 0
 			width: 100%
 			height: 100%

+// Dialog
+.ui-icon
+	display: inline-block !important
+
+#feature-state-dialog-link
+	text-decoration: none !important
+	padding: 5px !important
+	a:visited
+		color: #454545 !important
+	a code
+		display: inline-block !important
+		box-sizing: border-box !important
+		background-color: #f7f7f7 !important
+		color: #303030 !important
+		font-family: "Roboto Mono", monospace !important
+		vertical-align: baseline !important
+		font-size: 14px !important
+		font-weight: bold !important
+		padding: 0px 4px !important
+
+#feature-state-dialog
+	background: #fff !important
+	border: 1px solid #ddd !important
+	padding: 0.5em 1em !important
+
+	ul, li
+		list-style: disc !important
+		margin: 4px 12px !important
+
+	p
+		margin: 8px 0px !important
+
+	code
+		display: inline-block !important
+		box-sizing: border-box !important
+		background-color: #f7f7f7 !important
+		color: #303030 !important
+		font-family: "Roboto Mono", monospace !important
+		vertical-align: baseline !important
+		font-size: 14px !important
+		font-weight: bold !important
+		padding: 0px 4px !important
+
+.ui-dialog
+	background: #f7f7f7 !important
+	padding: 0.5em
+
+.ui-dialog-content
+	position: relative
+	float: right
+	width: 100%
+
+	$toc-margin: 15px
+	$header-clearance: $header-height + 20px
+
+	* + h2, * + h3, * + h4, * + h5, * + h6
+		margin-top: 30px
+
+	h1, h2, h3, h4, h5, h6
+		line-height: normal
+		font-weight: 500
+		margin-bottom: 30px
+		padding-bottom: 10px
+
+		// Make sure anchor links aren't hidden by the header
+		&:before
+			display: block
+			content: " "
+			margin-top: -$header-clearance
+			height: $header-clearance
+			visibility: hidden
+
+	h1,h2
+		border-bottom: 1px solid #cccccc
+		
+	h1
+		font-size: 32px
+		padding-right: 60px
+
+	h2
+		font-size: 28px
+
+	h3
+		font-size: 24px
+		font-weight: 300
+		margin-bottom: 5px
+
+	h4
+		font-size: 20px
+		margin-bottom: 0px
+
+	h5, h6
+		font-size: 16px
+		font-weight: 500
+
+	p
+		font-size: 16px
+		font-weight: 300
+		line-height: 1.75em
+
+	p + p
+		margin-top: 10px
+
+	code
+		display: inline-block
+		box-sizing: border-box
+		background-color: $light-grey
+		color: $dark-grey
+		font-family: $mono-font
+		vertical-align: baseline
+		font-size: 14px
+		font-weight: bold
+		padding: 2px 4px
+
+	a code
+		color: $blue
+		text-decoration: underline
+
+	pre .pi, pre .s
+		margin: 0
+		padding: 0
+
+	.highlight code span, code, pre code
+		font-family: "Roboto Mono", monospace
+
+	code, pre code
+		color: #303030
+
+	pre code
+		padding: 0
+
+	pre
+		background-color: #f7f7f7
+		display: block
+		margin: 20px 0
+		padding: 15px
+		position: relative
+		overflow-x: auto
+
+	h1 code, h2 code, h3 code, h4 code, h5 code, h6 code
+		font-family: inherit
+		font-size: inherit
+		background-color: transparent
+
+	.includecode
+		table-layout: fixed
+
+	.includecode, .includecode th, .includecode td
+		padding: 0 !important
+
+	.includecode th
+		text-align: right !important
+		padding: 10px !important
+
+	.includecode th a, .includecode th a code
+		color: white !important
+		background-color: transparent !important
+
+	.includecode pre
+		margin: 0 !important
+
+	ul li
+		list-style: disc
+
+	ol li
+		list-style: decimal
+
+	ul, ol
+		margin: 20px 0
+		padding-left: 30px
+		font-weight: 300
+
+	ul ul, ol ol, ul ol, ol ul
+		margin: 0.75em 0
+
+	li
+		margin-bottom: 0.75em
+		font-size: 16px
+		line-height: 1.75em
+
+	table
+		width: 100%
+		border: 1px solid #ccc
+		border-spacing: 0
+		margin-top: 30px
+		margin-bottom: 30px
+
+	thead, tr:nth-child(even)
+		background-color: $light-grey
+
+	thead
+		background-color: #555
+		color: white
+
+	th, td
+		padding: 8px
+		text-align: left
+		margin: 0
+
+	th
+		font-weight: normal
+
+	td
+		font-size: 0.85em
+
+	#editPageButton
+		position: absolute
+		top: -25px
+		right: 5px
+		width: 50px
+		height: 50px
+		line-height: 50px
+		border-radius: 50%
+		white-space: nowrap
+		text-indent: 50px
+		overflow: hidden
+		background: $blue url(/images/icon-pencil.svg) no-repeat
+		background-position: 12px 10px
+		background-size: 29px 29px
+
+	#markdown-toc
+		margin-bottom: 20px
+
+		ul, li
+			list-style: disc
+			color: $blue
+
+		ul
+			padding: 0 15px
+			margin: 0
+
+		li
+			padding: 0
+			line-height: 1.5em
+			margin-bottom: 0
+
+		a
+			position: relative
+			color: $blue
+			font-weight: 700
+
+	img
+		max-width: 100%
+
+	a
+		//font-weight: 700
+		text-decoration: underline
+
+//  a:visited
+//      color: blueviolet
+
+	a.button
+		border-radius: 2px
+		text-decoration: none
+		
+		&:visited
+			color: white
+
+	a.issue
+		margin-left: 0px
+
+.ui-dialog-buttonpane
+	background: #f7f7f7 !important
+
 // Tabs
 .ui-widget-header
 	background: transparent !important
@@ -1207,19 +1614,27 @@ $feature-box-div-margin-bottom: 40px
 		padding: 0px !important
 		list-style: none !important
 		margin-bottom: 0px !important
-		margin-left: 1px !important
+		margin-left: 4px !important
+
+.ui-tabs-panel
+	ul li
+		list-style: disc !important
+
+	ol li
+		list-style: decimal !important

 .ui-widget-content
 	border: 0px !important

-.ui-widget-content
 	table
 		margin: 0px !important

 .ui-tabs .ui-tabs-panel
-	padding: 0px !important
 	border: 1px solid #ccc !important

+.ui-tabs-anchor
+	text-decoration: none !important
+
 // Talk to us
 #talkToUs
 	h3, h4
@@ -1277,18 +1692,67 @@ $feature-box-div-margin-bottom: 40px


 #home
-	#talkToUs main
-		padding: 30px 0
+	#talkToUs
+		main
+			padding: 30px 0
+		
+		h5
+			font-size: 20px

-	#bigSocial
+
+	#caseStudiesWrapper
+		position: relative
+		text-align: center
+		margin-bottom: 30px
+		
 		div
-			padding-top: 125px
+			position: relative
+			display: inline-block
+			vertical-align: top
+			width: 100%
+			min-height: 230px
+			padding: 125px 10px 15px
+			margin-bottom: 30px
+			background-position: top center
+			background-repeat: no-repeat

 		div:nth-child(1)
-			background-image: url(/images/community_logos/viacom_logo.png)
+			background-image: url(/images/community_logos/pearson_logo.png)

 		div:nth-child(2)
-			background-image: url(/images/community_logos/ebay_logo.png)
+			background-image: url(/images/community_logos/box_logo.png)

 		div:nth-child(3)
+			background-image: url(/images/community_logos/ebay_logo.png)
+
+		div:nth-child(4)
 			background-image: url(/images/community_logos/wikimedia_foundation_logo.png)
+			
+		p
+			font-size: 20px
+			
+		a
+			position: absolute
+			bottom: 0
+			left: 50%
+			transform: translateX(-50%)
+			color: $blue
+			font-weight: 400
+
+	
+	//#bigSocial
+	//  text-align: center
+	//  
+	//  div
+	//      display: inline-block
+	//      float: none
+	//      padding-top: 125px
+	//      width: calc(90%)
+	//      
+	//      a
+	//          margin-top: 15px
+	//          font-size: 18px
+	//
+	//
+	//
+//
@@ -3,6 +3,15 @@ $vendor-strip-height: 44px
 $video-section-height: 550px

@media screen and (min-width: 1025px)
+	#hamburger
+		display: none
+
+	ul.global-nav
+		display: inline-block
+
+	#docs #vendorStrip #searchBox:before
+		top: 15px
+
 	#vendorStrip
 		height: $vendor-strip-height
 		line-height: $vendor-strip-height
@@ -40,7 +49,7 @@ $video-section-height: 550px

 				#searchBox
 					float: right
-					width: 30%
+					width: 320px

 				#search
 					vertical-align: middle
@@ -65,7 +74,7 @@ $video-section-height: 550px


 	#encyclopedia
-		padding: 50px 50px 20px 20px
+		padding: 50px 50px 100px 100px
 		clear: both

 	#docsToc
@@ -88,6 +97,11 @@ $video-section-height: 550px
 	section, header, footer
 		main
 			max-width: $main-max-width
+	
+	header, #vendorStrip, #encyclopedia, #hero h1, #hero h5, #docs #hero h1, #docs #hero h5,
+	#community #hero h1, .gridPage #hero h1, #community #hero h5, .gridPage #hero h5
+		padding-left: 100px
+		padding-right: 100px

 	#home
 		section, header, footer
@@ -121,7 +135,7 @@ $video-section-height: 550px
 	#video
 		height: $video-section-height
 		position: relative
-		background-image: url(../images/kub_video_thm.jpg)
+		background-image: url(../images/kub_video_banner.jpg)
 		background-position: center center
 		background-size: cover

@@ -134,21 +148,21 @@ $video-section-height: 550px

 		#bigSocial
 			div
-				width: calc(25% - 15px)
+				width: calc(25% - 18px)

 			div + div
 				margin-left: 20px
-
-			div:nth-child(3), div:nth-child(4)
-				margin-top: 0
+			//
+			//div:nth-child(3), div:nth-child(4)
+			//	margin-top: 0


-	#home #bigSocial
-		div
-			width: calc(33% - 15px)
-
-		div:nth-child(3)
-			margin-top: inherit
+	//#home #bigSocial
+	//	div
+	//		width: calc(33% - 15px)
+	//
+	//	div:nth-child(3)
+	//		margin-top: inherit

 	// FOOTER
 	footer
@@ -164,10 +178,11 @@ $video-section-height: 550px
 			margin-bottom: 20px

 			a
-				width: 25%
+				width: 16.65%
 				float: left
 				font-size: 24px
 				font-weight: 300
+				white-space: nowrap

 		.social
 			padding: 0 30px
@@ -270,14 +285,27 @@ $video-section-height: 550px



-	#community
+	#community, .gridPage
 		#hero
 			text-align: left

 			h1
-				padding: 20px
+				padding: 20px 100px

 		#tryKubernetes
 			width: auto
 			background-color: $blue
-			padding: 0 20px
+			padding: 0 20px
+			
+
+
+
+	#bigSocial
+		div
+			width: calc(25% - 18px)
+
+
+	#home #caseStudiesWrapper
+		div
+			width: 24%
+			min-height: 260px
@@ -15,7 +15,7 @@ ul, li
 ul
 	margin: 0
 	padding: 0
-
+	
 a
 	text-decoration: none

@@ -213,10 +213,8 @@ $feature-box-div-width: 45%
 			a
 				display: inline-block
 				color: $blue
-				font-size: 24px
 				font-weight: 400
 				text-decoration: none
-				margin-bottom: 15px

 	// FOOTER
 	footer
@@ -224,8 +222,7 @@ $feature-box-div-width: 45%
 			text-align: center

 			a
-				font-size: 22px
-				width: auto
+				width: 30%
 				padding: 0 20px

 		.social
@@ -244,3 +241,9 @@ $feature-box-div-width: 45%

 			input
 				text-align: left
+
+
+
+	#home #caseStudiesWrapper
+		div
+			width: 48%
@@ -0,0 +1,99 @@
+---
+title: Case Studies
+layout: basic
+class: gridPage
+cid: caseStudies
+---
+
+<section id="hero" class="light-text">
+    <h1>Kubernetes User Case Studies</h1>
+    <h5>A collection of users running Kubernetes in production.</h5>
+</section>
+
+<section id="mainContent">
+    <main>
+        <div class="content">
+            <div class="case-studies">
+                <div class="case-study">
+                    <img src="/images/case_studies/pearson.png" alt="Pearson">
+                    <p class="quote">"We chose Kubernetes because of its flexibility, ease of management and the way it improves our engineers' productivity."</p>
+                    <!--<p class="attrib">— Chris Jackson, Director for Cloud Product Engineering, Pearson</p>-->
+                    <a href="./pearson/">Read about Pearson</a>
+                </div>
+                <div class="case-study">
+                    <img src="/images/case_studies/wikimedia.png" alt="Wikimedia">
+                    <p class="quote">"With Kubernetes, we're simplifying our environment and making it easier for developers to build the tools that make wikis run better."</p>
+                    <!--<p class="attrib">— Yuvi Panda, Operations Engineer, Wikimedia Foundation</p>-->
+                    <a href="./wikimedia/">Read about Wikimedia</a>
+                </div>
+                <div class="case-study">
+                    <img src="/images/case_studies/ebay.png" alt="eBay">
+                    <p class="quote">Inside eBay's shift to Kubernetes and containers atop OpenStack</p>
+                    <a href="http://www.nextplatform.com/2015/11/12/inside-ebays-shift-to-kubernetes-and-containers-atop-openstack/">Read about eBay</a>
+                </div>
+                <div class="case-study">
+                    <img src="/images/case_studies/box.png" alt="box">
+                    <p class="quote">Kubernetes at Box: Microservices at Maximum Velocity</p>
+                    <a href="https://blog.box.com/blog/kubernetes-box-microservices-maximum-velocity/">Read about Box</a>
+                </div>
+            </div>
+        </div>
+    </main>
+</section>
+
+<section id="video">
+    <main>
+        <!--<div>-->
+            <!--<h3>"I don't want to deploy software the old way ever again"</h3>-->
+            <!--<p class="attrib">— Dylan Carney, Lead Software Engineer, Zulily</p>-->
+            <!--<img src="/images/case_studies/zulily.png" id="zulilyLogo" alt="zulily">-->
+        <!--</div>-->
+        <!--<div><button onclick="kub.showVideo()"><img src="/images/case_studies/video_thumb.jpg" alt="Zulily video"><h6>Kubernetes at zulily</h6></button></div>-->
+        <div>
+            <!--<h3>SAP</h3>-->
+            <h3>SAP's OpenStack, running on Kubernetes in production</h3>
+            <img src="/images/case_studies/sap_small.png" id="zulilyLogo" alt="SAP">
+        </div>
+        <div><button onclick="kub.showVideo()"><img src="/images/case_studies/video_thumb1.png" alt="SAP video"><h6>Kubernetes at SAP</h6></button></div>
+    </main>
+</section>
+
+<section id="users">
+    <main>
+        <h3>Kubernetes Users</h3>
+        <div id="usersGrid">
+            <a target="_blank" href="https://www.youtube.com/watch?v=P5qfyv_zGcU"><img src="/images/case_studies/nyt.png" alt="New York Times"></a>
+            <a target="_blank" href="https://openai.com/blog/infrastructure-for-deep-learning"><img src="/images/case_studies/openai.png" alt="OpenAI"></a>
+            <a target="_blank" href="http://blogs.wsj.com/cio/2016/02/24/big-changes-in-goldmans-software-emerge-from-small-containers/"><img src="/images/case_studies/gs.png" alt="Goldman Sachs"></a>
+            <a target="_blank" href="https://youtu.be/4gyeixJLabo"><img src="/images/case_studies/sap.png" alt="SAP"></a>
+            <a target="_blank" href="http://www.nextplatform.com/2016/05/24/samsung-experts-put-kubernetes-paces/"><img src="/images/case_studies/sds.png" alt="Samsung SDS"></a>
+            <a target="_blank" href="http://thenewstack.io/wepay-kubernetes-changed-business/"><img src="/images/case_studies/wepay.png" alt="WePay"></a>
+            <a target="_blank" href="https://www.youtube.com/watch?v=5378N5iLb2Q"><img src="/images/case_studies/soundcloud.png" alt="SoundCloud"></a>
+            <a target="_blank" href="https://www.youtube.com/watch?v=F3iMkz_NSvU"><img src="/images/case_studies/homeoffice.png" alt="UK Home Office"></a>
+            <a target="_blank" href="http://searchitoperations.techtarget.com/news/450297178/Tech-firms-roll-out-Kubernetes-in-production"><img src="/images/case_studies/concur.png" alt="Concur"></a>
+            <a target="_blank" href="http://www.nextplatform.com/2015/08/04/amadeus-takes-off-with-containers-and-clouds/"><img src="/images/case_studies/amadeus.png" alt="Amadeus"></a>
+            <a target="_blank" href="http://superuser.openstack.org/articles/how-ancestry-com-s-open-source-strategy-combines-kubernetes-and-openstack"><img src="/images/case_studies/ancestry.png" alt="Ancestry.com"></a>
+            <a target="_blank" href="https://cloud.google.com/customers/ccp-games/"><img src="/images/case_studies/ccp.png" alt="CCP Games"></a>
+            <a target="_blank" href="https://www.openstack.org/videos/video/running-kubernetes-on-openstack-at-liveperson"><img src="/images/case_studies/liveperson.png" alt="LivePerson"></a>
+            <a target="_blank" href="https://youtu.be/YkOY7DgXKyw"><img src="/images/case_studies/monzo_logo.png" alt="monzo"></a>
+            <a target="_blank" href="https://blog.box.com/blog/kubernetes-box-microservices-maximum-velocity/"><img src="/images/case_studies/box_logo.png" alt="Box"></a>
+            <a target="_blank" href="https://cloudplatform.googleblog.com/2016/09/bringing-Pokemon-GO-to-life-on-Google-Cloud.html"><img src="/images/case_studies/pokemon_go_logo.png" alt="Pokemon GO"></a>
+            <a target="_blank" href="http://blog.kubernetes.io/2016/10/kubernetes-and-openstack-at-yahoo-japan.html"><img src="/images/case_studies/yahooJapan_logo.png" alt="Yahoo! Japan"></a>
+            <a target="_blank" href="https://cloud.google.com/customers/philips/"><img src="/images/case_studies/philips_logo.png" alt="Philips"></a>
+            <a target="_blank" href="https://youtu.be/EC_ZRLsw58M"><img src="/images/case_studies/buffer_logo.png" alt="buffer"></a>
+            <a target="_blank" href="https://youtu.be/lmeFkH-rHII"><img src="/images/case_studies/comcast_logo.png" alt="Comcast"></a>
+            <a href="./wikimedia/"><img src="/images/case_studies/wikimedia_logo.png" alt="Wikimedia"></a>
+            <a href="./pearson/"><img src="/images/case_studies/pearson_logo.png" alt="Pearson"></a>
+            <a target="_blank" href="#" onclick="event.preventDefault(); kub.showVideo()"><img src="/images/case_studies/zulily_logo.png" alt="zulily"></a>
+            <a target="_blank" href="http://www.nextplatform.com/2015/11/12/inside-ebays-shift-to-kubernetes-and-containers-atop-openstack/"><img src="/images/case_studies/ebay_logo.png" alt="Ebay"></a>
+            <a target="_blank" href="https://docs.google.com/a/google.com/forms/d/e/1FAIpQLScuI7Ye3VQHQTwBASrgkjQDSS5TP0g3AXfFhwSM9YpHgxRKFA/viewform" class="tell-your-story"><img src="/images/case_studies/story.png" alt="Tell your story"></a>
+        </div>
+    </main>
+</section>
+
+
+<div id="videoPlayer">
+    <!--<iframe data-url="https://www.youtube.com/watch?v=B0_5Nms8sD0" frameborder="0" allowfullscreen></iframe>-->
+    <iframe data-url="https://www.youtube.com/embed/4gyeixJLabo?autoplay=1" frameborder="0" allowfullscreen="true"></iframe>
+    <button id="closeButton"></button>
+</div>
@@ -0,0 +1,81 @@
+---
+title: Pearson Case Study
+layout: basic
+class: gridPage
+cid: caseStudies
+---
+
+<section id="hero" class="light-text">
+    <h1> Pearson Case Study</h1>
+</section>
+
+<section id="mainContent">
+    <main>
+        <div class="content">
+            <h3 id="caseStudyTitle">Using Kubernetes to reinvent the world's largest educational company</h3>
+            <p>
+                Pearson, the world's education company, serving 75 million learners worldwide, set a goal to more than double that number to 200 million by 2025. A key part of this growth is in digital learning experiences, and that  requires an infrastructure platform that is able to scale quickly and deliver products to market faster. So Pearson's Cloud Technology team chose Kubernetes to help build a platform to meet the business requirements.            </p>
+            <div class="feature">
+                <img src="/images/case_studies/pearson.png" alt="Pearson">
+                <p class="quote">
+                    "To transform our infrastructure, we had to think beyond simply enabling automated provisioning, we realized we had to build a platform that would allow Pearson developers to build manage and deploy applications in a completely different way. We chose Kubernetes because of its flexibility, ease of management and the way it would improve our engineers' productivity."                </p>
+                <p class="attrib">— Chris Jackson, Director for Cloud Product Engineering, Pearson</p>
+            </div>
+        </div>
+    </main>
+</section>
+
+<section class="bullets">
+    <main>
+        <div class="content">
+            <div class="bullet">
+                <h4>Challenges:</h4>
+                <ul>
+                    <li>Pearson had difficulty in scaling and adapting to the growing online audience. They wanted to build and deliver content primarily over the web.</li>
+                </ul>
+            </div>
+            <div class="bullet">
+                <h4>Why Kubernetes:</h4>
+                <ul>
+                    <li>Kubernetes will allow Pearson's teams to develop their apps in a consistent manner, saving time and minimizing complexity.</li>
+                </ul>
+            </div>
+            <div class="bullet">
+                <h4>Approach:</h4>
+                <ul>
+                    <li>Build a centralized platform for use across the entire enterprise</li>
+                    <li>Use container technology as the core of the platform</li>
+                    <li>Deploy Kubernetes to manage the platform</li>
+                </ul>
+            </div>
+            <div class="bullet">
+                <h4>Results:</h4>
+                <ul>
+                    <li>Pearson is building an enterprise-wide platform for delivering innovative, web-based educational content. They expect engineers' productivity to increase by up to 20 percent.</li>
+                </ul>
+            </div>
+        </div>
+    </main>
+</section>
+
+<section class="details">
+    <main>
+        <div class="content">
+            <h4>Kubernetes powers a comprehensive developer experience</h4>
+            <p>Pearson wanted to use as much open source technology as possible for the platform given that it provides both technical and commercial benefits over the duration of the project. Jackson says, "Building an infrastructure platform based on open source technology in Pearson was a no-brainer, the sharing of technical challenges and advanced use cases in a community of people with talent far beyond what we could hire independently allows us to innovate at a level we could not reach on our own. Our engineers enjoy returning code to the community and participating in talks, blogs and meetings, it's a great way for us to allow our team to express themselves and share the pride they have in their work."</p>
+            <p>It also wanted to use a container-focused platform. Pearson has 400 development groups and diverse brands with varying business and technical needs. With containers, each brand could experiment with building new types of content using their preferred technologies, and then deliver it using containers. Pearson chose Kubernetes because it believes that is the best technology for managing containers, has the widest community support and offers the most flexible and powerful tools."</p>
+            <p>Kubernetes is at the core of the platform we've built for developers. After we get our big spike in back-to-school in traffic, much of Pearson's traffic will interact with Kubernetes. It is proving to be as effective as we had hoped," Jackson says.</p>
+        </div>
+    </main>
+</section>
+
+<section class="details">
+    <main>
+        <div class="content">
+            <h4>Encouraging experimentation, saving engineers time</h4>
+            <p>With the new platform, Pearson will increase stability and performance, and to bring products to market more quickly. The company says its engineers will also get a productivity boost because they won't spend time managing infrastructure. Jackson estimates 15 to 20 percent in productivity savings.</p>
+            <p>Beyond that, Pearson says the platform will encourage innovation because of the ease with which new applications can be developed, and because applications will be deployed far more quickly than in the past. It expects that will help the company meet its goal of reaching 200 million learners within the next 10 years.</p>
+            <p>"We're already seeing tremendous benefits with Kubernetes — improved engineering productivity, faster delivery of applications and a simplified infrastructure. But this is just the beginning. Kubernetes will help transform the way that educational content is delivered online," says Jackson.</p>
+        </div>
+    </main>
+</section>
@@ -0,0 +1,96 @@
+---
+title: Wikimedia Case Study
+layout: basic
+class: gridPage
+cid: caseStudies
+---
+
+<section id="hero" class="light-text">
+    <h1> Wikimedia Case Study</h1>
+</section>
+
+<section id="mainContent">
+    <main>
+        <div class="content">
+            <h3 id="caseStudyTitle">Using Kubernetes to Build Tools to Improve the World's Wikis</h3>
+            <p>
+                The non-profit Wikimedia Foundation operates some of the largest collaboratively edited reference projects in the world, including Wikipedia. To help users maintain and use wikis, it runs Wikimedia Tool Labs, a hosting environment for community developers working on tools and bots to help editors and other volunteers do their work, including reducing vandalism. The community around Wikimedia Tool Labs began forming nearly 10 years ago.
+            </p>
+            <div class="feature">
+                <img src="/images/case_studies/wikimedia.png" alt="Wikimedia">
+                <p class="quote">
+                    "Wikimedia Tool Labs is vital for making sure wikis all around the world work as well as they possibly can. Because it's grown organically for almost 10 years, it has become an extremely challenging environment and difficult to maintain. It's like a big ball of mud — you really can't see through it. With Kubernetes, we're simplifying the environment and making it easier for developers to build the tools that make wikis run better."
+                </p>
+                <p class="attrib">— Yuvi Panda, operations engineer at Wikimedia Foundation and Wikimedia Tool Labs</p>
+            </div>
+        </div>
+    </main>
+</section>
+
+<section class="bullets">
+    <main>
+        <div class="content">
+            <div class="bullet">
+                <h4>Challenges:</h4>
+                <ul>
+                    <li>Simplify a complex, difficult-to-manage infrastructure</li>
+                    <li>Allow developers to continue writing tools and bots using existing techniques</li>
+                </ul>
+            </div>
+            <div class="bullet">
+                <h4>Why Kubernetes:</h4>
+                <ul>
+                    <li>Wikimedia Tool Labs chose Kubernetes because it can mimic existing workflows, while reducing complexity</li>
+                </ul>
+            </div>
+            <div class="bullet">
+                <h4>Approach:</h4>
+                <ul>
+                    <li>Migrate old systems and a complex infrastructure to Kubernetes</li>
+                </ul>
+            </div>
+            <div class="bullet">
+                <h4>Results:</h4>
+                <ul>
+                    <li>20 percent of web tools that account for more than 40 percent of web traffic now run on Kubernetes</li>
+                    <li>A 25-node cluster that keeps up with each new Kubernetes release</li>
+                    <li>Thousands of lines of old code have been deleted, thanks to Kubernetes</li>
+                </ul>
+            </div>
+        </div>
+    </main>
+</section>
+
+<section class="details">
+    <main>
+        <div class="content">
+            <h4>Using Kubernetes to provide tools for maintaining wikis</h4>
+            <p>
+                Wikimedia Tool Labs is run by a staff of four-and-a-half paid employees and two volunteers. The infrastructure didn't make it easy or intuitive for developers to build bots and other tools to make wikis work more easily. Yuvi says, "It's incredibly chaotic. We have lots of Perl and Bash duct tape on top of it. Everything is super fragile."
+            </p>
+            <p>
+                To solve the problem, Wikimedia Tool Labs migrated parts of its infrastructure to Kubernetes, in preparation for eventually moving its entire system. Yuvi said Kubernetes greatly simplifies maintenance. The goal is to allow developers creating bots and other tools to use whatever development methods they want, but make it easier for the Wikimedia Tool Labs to maintain the required infrastructure for hosting and sharing them.
+            </p>
+            <p>
+                "With Kubernetes, I've been able to remove a lot of our custom-made code, which makes everything easier to maintain. Our users' code also runs in a more stable way than previously," says Yuvi.
+            </p>
+        </div>
+    </main>
+</section>
+
+<section class="details">
+    <main>
+        <div class="content">
+            <h4>Simplifying infrastructure and keeping wikis running better</h4>
+            <p>
+                Wikimedia Tool Labs has seen great success with the initial Kubernetes deployment. Old code is being simplified and eliminated, contributing developers don't have to change the way they write their tools and bots, and those tools and bots run in a more stable fashion than they have in the past. The paid staff and volunteers are able to better keep up with fixing issues.
+            </p>
+            <p>
+                In the future, with a more complete migration to Kubernetes, Wikimedia Tool Labs expects to make it even easier to host and maintain the bots and tools that help run wikis across the world. The tool labs already host approximately 1,300 tools and bots from 800 volunteers, with many more being submitted every day. Twenty percent of the tool labs' web tools that account for more than 60 percent of web traffic now run on Kubernetes. The tool labs has a 25-node cluster that keeps up with each new Kubernetes release. Many existing web tools are migrating to Kubernetes.
+            </p>
+            <p>
+                "Our goal is to make sure that people all over the world can share knowledge as easily as possible. Kubernetes helps with that, by making it easier for wikis everywhere to have the tools they need to thrive," says Yuvi.
+            </p>
+        </div>
+    </main>
+</section>
@@ -1,112 +0,0 @@
---
-title: Community
---
-
-<!Doctype html>
-<html id="community">
-{% include head-header.html %}
-
-<section id="hero" class="light-text">
-	<h1>Community</h1>
-</section>
-
-
-
-<section id="mainContent">
-	<main>
-		<div class="content">
-			<h3>Ensuring Kubernetes works well everywhere and for everyone.</h3>
-			<p>Connect with the Kubernetes community on our <a href="http://slack.k8s.io/">Slack channel</a> or join the
-				<a href="https://groups.google.com/forum/#!forum/kubernetes-dev">Kubernetes-dev Google group</a>. A weekly
-				community meeting takes place via video conference to discuss the state of affairs,
-				<a href="https://groups.google.com/forum/#!forum/kubernetes-community-video-chat">get a calendar invite</a>
-				to participate.</p>
-		</div>
-		<div class="content">
-			<h3>SIGs</h3>
-			<p>Have a special interest in how Kubernetes works with another technology?  See our ever growing
-				<a href="https://github.com/kubernetes/kubernetes/wiki/Special-Interest-Groups-(SIGs)">lists of SIGs</a>,
-				from AWS and Openstack to Big Data and Scalability, there’s a place for you to contribute and instructions
-				for forming a new SIG if your special interest isn’t covered (yet).</p>
-		</div>
-		<div class="content">
-			<h3>Customers</h3>
-			<div class="company-logos">
-				<img src="/images/community_logos/zulily_logo.png">
-				<img src="/images/community_logos/we_pay_logo.png">
-				<img src="/images/community_logos/goldman_sachs_logo.png">
-				<img src="/images/community_logos/ebay_logo.png">
-				<img src="/images/community_logos/box_logo.png">
-				<img src="/images/community_logos/wikimedia_logo.png">
-				<img src="/images/community_logos/soundcloud_logo.png">
-				<img src="/images/community_logos/new_york_times_logo.png">
-				<img src="/images/community_logos/kabam_logo.png">
-			</div>
-		</div>
-		<div class="content">
-			<h3>Events</h3>
-			<div id="calendarWrapper">
-				<iframe src="https://calendar.google.com/calendar/embed?src=nt2tcnbtbied3l6gi2h29slvc0%40group.calendar.google.com&ctz=America/Los_Angeles"
-				        frameborder="0" scrolling="no"></iframe>
-			</div>
-		</div>
-		<div class="content">
-			<h3>Partners</h3>
-			<p>We are working with a broad group of partners who contribute to the kubernetes core codebase, making it stronger and richer, as well as help in growing the kubernetes ecosystem supporting
-				a sprectrum of compelmenting platforms, from open source solutions to market-leading technologies.</p>
-			<div class="partner-logos">
-        <a href="https://coreos.com/kubernetes"><img src="/images/community_logos/core_os_logo.png"></a>
-				<a href="https://deis.com"><img src="/images/community_logos/deis_logo.png"></a>
-				<a href="https://sysdig.com/blog/monitoring-kubernetes-with-sysdig-cloud/"><img src="/images/community_logos/sysdig_cloud_logo.png"></a>
-				<a href="https://puppet.com/blog/managing-kubernetes-configuration-puppet"><img src="/images/community_logos/puppet_logo.png"></a>
-				<a href="https://www.citrix.com/blogs/2016/07/15/citrix-kubernetes-a-home-run/"><img src="/images/community_logos/citrix_logo.png"></a>
-				<a href="http://wercker.com/workflows/partners/kubernetes/"><img src="/images/community_logos/wercker_logo.png"></a>
-				<a href="http://rancher.com/kubernetes/"><img src="/images/community_logos/rancher_logo.png"></a>
-				<a href="https://www.openshift.com/"><img src="/images/community_logos/red_hat_logo.png"></a>
-				<a href="https://tectonic.com/press/intel-coreos-collaborate-on-openstack-with-kubernetes.html"><img src="/images/community_logos/intel_logo.png"></a>
-				<a href="https://elasticbox.com/kubernetes/"><img src="/images/community_logos/elastickube_logo.png"></a>
-				<a href="https://platform9.com/blog/containers-as-a-service-kubernetes-docker"><img src="/images/community_logos/platform9_logo.png"></a>
-				<a href="http://www.appformix.com/solutions/appformix-for-kubernetes/"><img src="/images/community_logos/appformix_logo.png"></a>
-				<a href="http://kubernetes.io/docs/getting-started-guides/dcos/"><img src="/images/community_logos/mesosphere_logo.png"></a>
-				<a href="http://docs.datadoghq.com/integrations/kubernetes/"><img src="/images/community_logos/datadog_logo.png"></a>
-				<a href="https://apprenda.com/kubernetes-support/"><img src="/images/community_logos/apprenda_logo.png"></a>
-				<a href="http://www.ibm.com/cloud-computing/"><img src="/images/community_logos/ibm_logo.png"></a>
-				<a href="http://info.crunchydata.com/blog/advanced-crunchy-containers-for-postgresql"><img src="/images/community_logos/crunchy_data_logo.png"></a>
-				<a href="https://content.mirantis.com/Containerizing-OpenStack-on-Kubernetes-Video-Landing-Page.html"><img src="/images/community_logos/mirantis_logo.png"></a>
-				<a href="http://blog.aquasec.com/security-best-practices-for-kubernetes-deployment"><img src="/images/community_logos/aqua_logo.png"></a>
-				<a href="https://jujucharms.com/canonical-kubernetes/"><img src="/images/community_logos/ubuntu_cannonical_logo.png"></a>
-				<a href="https://github.com/nuagenetworks/nuage-kubernetes"><img src="/images/community_logos/nuage_network_logo.png"></a>
-			</div>
-		</div>
-	</main>
-</section>
-
-<section id="talkToUs">
-	<main>
-		<h3>Talk to Us!</h3>
-		<h4>We would love to hear from you, how you are using Kubernetes,<br> and what we can do to make it better.</h4>
-		<div id="bigSocial">
-			<div>
-				<a href="https://twitter.com/kubernetesio">@kubernetesio</a>
-				<p>Get the latest news and updates.</p>
-			</div>
-			<div>
-				<a href="https://github.com/kubernetes/kubernetes">Github Project</a>
-				<p>Check out the project and consider contributing.</p>
-			</div>
-			<div>
-				<a href="http://slack.k8s.io/">#kubernetes-users</a>
-				<p>Our Slack channel is the best way to contact our engineers and share your ideas with them.</p>
-			</div>
-			<div>
-				<a href="http://stackoverflow.com/questions/tagged/kubernetes">Stack Overflow</a>
-				<p>Our user forum is a great place to go for community support.</p>
-			</div>
-		</div>
-	</main>
-</section>
-
-{% include footer.html %}
-
-</body>
-</html>
@@ -0,0 +1,71 @@
+---
+title: Community
+layout: basic
+cid: community
+---
+
+<section id="hero" class="light-text">
+    <h1>Community</h1>
+</section>
+
+<section id="mainContent">
+    <main>
+        <div class="content">
+            <h3>Ensuring Kubernetes works well everywhere and for everyone.</h3>
+            <p>Connect with the Kubernetes community on our <a href="http://slack.k8s.io/">Slack channel</a> or join the
+                <a href="https://groups.google.com/forum/#!forum/kubernetes-dev">Kubernetes-dev Google group</a>. A weekly
+                community meeting takes place via video conference to discuss the state of affairs,
+                <a href="https://groups.google.com/forum/#!forum/kubernetes-community-video-chat">get a calendar invite</a>
+                to participate.</p>
+            <p>You can also join Kubernauts all around the world through our
+                <a href="https://www.meetup.com/topics/kubernetes/">Kubernetes Meetup Community</a> and the
+                <a href="https://www.meetup.com/Kubernetes-Cloud-Native-Online-Meetup/">Kubernetes Cloud Native Meetup Community</a>.</p>
+        </div>
+        <div class="content">
+            <h3>Special Interest Groups (SIGs)</h3>
+            <p>Have a special interest in how Kubernetes works with another technology?  See our ever growing
+                <a href="https://github.com/kubernetes/kubernetes/wiki/Special-Interest-Groups-(SIGs)">lists of SIGs</a>,
+                from AWS and Openstack to Big Data and Scalability, there's a place for you to contribute and instructions
+                for forming a new SIG if your special interest isn't covered (yet).</p>
+
+            <p>As a member of the Kubernetes community, you are welcome to join any of the SIG meetings
+                you are interested in. No registration required.</p>
+            <div id="calendarMeetings">
+                <iframe src="https://calendar.google.com/calendar/embed?src=cgnt364vd8s86hr2phapfjc6uk%40group.calendar.google.com&ctz=America/Los_Angeles"
+                        frameborder="0" scrolling="no"></iframe>
+            </div>
+        </div>
+        <div class="content">
+            <h3>Events</h3>
+            <div id="calendarEvents">
+                <iframe src="https://calendar.google.com/calendar/embed?src=nt2tcnbtbied3l6gi2h29slvc0%40group.calendar.google.com&ctz=America/Los_Angeles"
+                        frameborder="0" scrolling="no"></iframe>
+            </div>
+        </div>
+    </main>
+</section>
+
+<section id="talkToUs">
+    <main>
+        <h3>Talk to Us!</h3>
+        <h4>We would love to hear from you, how you are using Kubernetes,<br> and what we can do to make it better.</h4>
+        <div id="bigSocial">
+            <div>
+                <a href="https://twitter.com/kubernetesio">@kubernetesio</a>
+                <p>Get the latest news and updates.</p>
+            </div>
+            <div>
+                <a href="https://github.com/kubernetes/kubernetes">Github Project</a>
+                <p>Check out the project and consider contributing.</p>
+            </div>
+            <div>
+                <a href="http://slack.k8s.io/">#kubernetes-users</a>
+                <p>Our Slack channel is the best way to contact our engineers and share your ideas with them.</p>
+            </div>
+            <div>
+                <a href="http://stackoverflow.com/questions/tagged/kubernetes">Stack Overflow</a>
+                <p>Our user forum is a great place to go for community support.</p>
+            </div>
+        </div>
+    </main>
+</section>
@@ -0,0 +1,6 @@
+.deprecation-warning {
+	padding: 20px;
+	margin: 20px 0;
+	border-radius: 3px;
+	background-color: #eeeeee;
+}
@@ -0,0 +1,310 @@
+#caseStudyTitle {
+    margin-top: 1em !important;
+}
+
+.gridPage p {
+    color: rgb(26,26,26) !important;
+    margin-left: 0 !important;
+    padding-left: 0 !important;
+    font-weight: 300 !important;
+}
+
+.gridPage #mainContent {
+    padding: 0;
+}
+
+.gridPage #mainContent .content {
+    padding-top: 0;
+}
+
+.gridPage main {
+    max-width: 1100px !important;
+}
+
+.gridPage .content {
+    position: relative;
+    margin: 0 auto 50px;
+    max-width: 90%;
+}
+
+.gridPage .content p {
+    line-height: 24px !important;
+}
+
+.gridPage .content h3 {
+    padding: 0 !important;
+}
+
+.gridPage #hero h5 {
+    padding-left: 20px;
+    margin: 0;
+}
+
+.case-studies {
+    position: relative;
+    display: flex;
+    justify-content: space-between;
+    flex-wrap: wrap;
+    margin-top: 50px;
+}
+
+.case-study {
+    position: relative;
+    width: 50%;
+    padding: 0 40px 0 242px;
+    margin-bottom: 60px;
+    min-height: 152px;
+}
+
+.case-study:nth-child(3), .case-study:nth-child(4) {
+    margin-bottom: 0;
+}
+
+.case-study img {
+    position: absolute;
+    top: 0;
+    left: 0;
+}
+
+.gridPage #mainContent .content .case-study p {
+    font-family: "Roboto", sans-serif;
+    font-size: 16px;
+    padding: 0;
+}
+
+p.attrib {
+    font-style: italic;
+}
+
+.gridPage #video {
+    background: #f9f9f9;
+    height: auto;
+    /*height: 340px;*/
+}
+
+.gridPage #video main {
+    position: relative;
+    max-width: 900px !important;
+    height: 100%;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    padding: 50px 20px;
+}
+
+.gridPage #video main > div {
+    width: 50%;
+}
+
+.gridPage #video main #zulilyLogo {
+    width: 100px;
+}
+
+.gridPage #video main img {
+    max-width: 100%;
+}
+
+.gridPage #video h3 {
+    font-size: 32px;
+    font-weight: 300;
+    line-height: 38px;
+    max-width: 80%;
+    margin: 0 0 1em 0;
+}
+
+.gridPage #video p {
+    margin: 0;
+}
+
+.gridPage #video p.attrib {
+    margin-bottom: 20px;
+}
+
+.gridPage #video button > h6 {
+    font-size: 18px;
+    font-weight: 500;
+    margin: 1em 0;
+    color: #326de6;
+}
+
+.gridPage #users {
+    padding: 50px;
+}
+
+.gridPage #users main {
+    max-width: 1150px !important;
+}
+
+.gridPage #users main h3 {
+    padding-left: 20px;
+    margin-bottom: 20px;
+}
+
+.gridPage #usersGrid {
+    position: relative;
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: center;
+}
+
+.gridPage #usersGrid a {
+    display: inline-block;
+    margin: 5px;
+}
+
+.gridPage #usersGrid a img {
+    box-shadow: 1px 1px 2px transparent;
+    transition: box-shadow 0.25s;
+}
+
+.gridPage #usersGrid a img:hover {
+    box-shadow: 1px 1px 2px #cccccc;
+}
+
+.gridPage #usersGrid a:last-child img,
+.gridPage #usersGrid a:last-child img:hover {
+    box-shadow: 1px 1px 2px transparent;
+}
+
+.tell-your-story {
+    border: 1px solid #dddddd;
+    border-radius: 6px;
+    box-shadow: 1px 2px 2px #dddddd;
+}
+
+.gridPage .feature {
+    position: relative;
+    padding: 20px 0 20px 242px;
+}
+
+.gridPage .feature img {
+    position: absolute;
+    top: 20px;
+    left: 0;
+}
+
+section.bullets {
+    background-color: #eeeeee;
+    margin-bottom: 50px;
+}
+
+section.bullets main {
+    position: relative;
+    max-width: 1100px;
+    padding: 50px 0;
+}
+
+section.bullets .content {
+    position: relative;
+    display: flex;
+    flex-wrap: wrap;
+    margin-bottom: 0 !important;
+}
+
+.bullet {
+    position: relative;
+    width: 50%;
+    padding: 15px 30px;
+}
+
+.bullet h4 {
+    margin-bottom: 0.5em;
+}
+
+.bullet li {
+    margin-left: 1.25em;
+    list-style: disc;
+    font-weight: 300;
+    color: rgb(26,26,26);
+    line-height: 1.5em;
+    margin-bottom: 0.5em;
+}
+
+.details h4, p {
+    margin-bottom: 0.5em;
+}
+
+.gridPage .feature p.quote {
+    font-size: 20px;
+    line-height: 28px !important;
+}
+
+@media screen and (max-width: 1024px){
+    .case-study {
+        padding: 0 10%;
+        margin-bottom: 50px;
+    }
+
+    .case-study img {
+        position: relative;
+    }
+
+    .case-study p.quote {
+        margin-top: 20px !important;
+    }
+
+    .case-study p.attrib {
+        font-style: italic;
+    }
+}
+
+@media screen and (max-width: 900px){
+    .gridPage #video main {
+        flex-direction: column;
+        align-items: center;
+    }
+
+    .gridPage #video main > div {
+        width: 400px;
+    }
+
+    .gridPage #video main > div + div {
+        margin-top: 30px;
+    }
+
+    .gridPage #video h3 {
+        max-width: 100%;
+    }
+}
+
+@media screen and (max-width: 640px){
+    .case-study {
+        width: 100%;
+    }
+
+    .case-study:nth-child(3) {
+        margin-bottom: 60px;
+    }
+
+    .case-study img {
+        left: 50%;
+        transform: translateX(-50%);
+    }
+
+    .gridPage .feature {
+        margin-top: 50px;
+        padding: 180px 0 0;
+    }
+
+    .gridPage .feature img {
+        top: 0;
+        left: 50%;
+        transform: translateX(-50%);
+    }
+}
+
+@media screen and (max-width: 480px){
+    .gridPage #hero {
+        padding-right: 20px;
+        padding-left: 20px;
+    }
+
+    .gridPage #video main > div {
+        width: 80%;
+        min-width: 280px;
+    }
+
+    .bullet {
+        width: 100%;
+    }
+}
@@ -3,7 +3,7 @@ assignees:
 - bgrant0607
 - erictune
 - lavalamp
-
+title: Overview
 ---

 This document describes how access to the Kubernetes API is controlled.
@@ -24,7 +24,7 @@ following diagram:
 In a typical Kubernetes cluster, the API served on port 443.  A TLS connection is
 established.  The API server presents a certificate.  This certificate is
 often self-signed, so `$USER/.kube/config` on the user's machine typically
-contains the root certficate for the API server's certificate, which when specified
+contains the root certificate for the API server's certificate, which when specified
 is used in place of the system default root certificates.  This certificate is typically
 automatically written into your `$USER/.kube/config` when you create a cluster yourself
 using `kube-up.sh`.  If the cluster has multiple users, then the creator needs to share
@@ -52,8 +52,8 @@ On GCE, Client Certificates, Password, Plain Tokens, and JWT Tokens are all enab
 If the request cannot be authenticated, it is rejected with HTTP status code 401.
 Otherwise, the user is authenticated as a specific `username`, and the user name
 is available to subsequent steps to use in their decisions.  Some authenticators
-may also provide the group memberships of the user, while other authenticators
-do not (and expect the authorizer to determine these).
+also provide the group memberships of the user, while other authenticators
+do not.

 While Kubernetes uses "usernames" for access control decisions and in request logging,
 it does not have a `user` object nor does it store usernames or other information about
@@ -63,7 +63,7 @@ users in its object store.

 Once the request is authenticated as coming from a specific user,
 it moves to a generic authorization step.  This is shown as step **2** in the
-diagram. 
+diagram.

 The input to the Authorization step are attributes of the REST request, including:
  - the username determined by the Authentication step.
@@ -80,13 +80,13 @@ then the request can proceed.  If all deny the request, then the request is deni
 code 403).

 The [Authorization Modules](/docs/admin/authorization) page describes what authorization modules
-are available and how to configure them.    
+are available and how to configure them.

 For version 1.2, clusters created by `kube-up.sh` are configured so that no authorization is
 required for any request.

 As of version 1.3, clusters created by `kube-up.sh` are configured so that the ABAC authorization
-modules is enabled.  However, its input file is initially set to allow all users to do all
+modules are enabled.  However, its input file is initially set to allow all users to do all
 operations.  The cluster administrator needs to edit that file, or configure a different authorizer
 to restrict what users can do.

@@ -94,7 +94,7 @@ to restrict what users can do.
 The Authorization step is designed to operate on attributes that are likely to be common to most
 REST requests, such as object name, kind, etc.  This is intended to facilitate interation with
 existing organization-wide or cloud-provider-wide access control systems (which may handle
-other APIs besides the Kubernetes API.
+other APIs besides the Kubernetes API).

 Access controls and policies that depend on specific fields of specific Kinds of objects
 are handled by Admission Controllers.
@@ -108,7 +108,7 @@ They act on objects being created, deleted, updated or connected (proxy), but no

 Multiple admission controllers can be configured.  Each is called in order.

-This is shown as step **3** in the diagram. 
+This is shown as step **3** in the diagram.

 Unlike Authentication and Authorization Modules, if any admission controller module
 rejects, then the request is immediately rejected.
@@ -122,17 +122,17 @@ Once a request passes all admission controllers, it is validated using the valid
 for the corresponding API object, and then written to the object store (shown as step **4**).


-## API Server Ports and IPs 
+## API Server Ports and IPs

 The previous discussion applies to requests sent to the secure port of the API server
 (the typical case).  The API server can actually serve on 2 ports:

-By default the Kubernetes APIserver serves HTTP on 2 ports:
+By default the Kubernetes API server serves HTTP on 2 ports:

  1. `Localhost Port`:

          - is intended for testing and bootstrap, and for other components of the master node
-	    (scheduler, controller-manager) to talk to the API
+            (scheduler, controller-manager) to talk to the API
          - no TLS
          - default is port 8080, change with `--insecure-port` flag.
          - defaults IP is localhost, change with `--insecure-bind-address` flag.
@@ -141,14 +141,14 @@ By default the Kubernetes APIserver serves HTTP on 2 ports:
          - protected by need to have host access

  2. `Secure Port`:
- 
+
          - use whenever possible 
          - uses TLS.  Set cert with `--tls-cert-file` and key with `--tls-private-key-file` flag.
          - default is port 6443, change with `--secure-port` flag.
          - default IP is first non-localhost network interface, change with `--bind-address` flag.
          - request handled by authentication and authorization modules.
          - request handled by admission control module(s).
-          - authentication and authoriation modules run.
+          - authentication and authorisation modules run.

 When the cluster is created by `kube-up.sh`, on Google Compute Engine (GCE),
 and on several other cloud providers, the API server serves on port 443.  On
@@ -1,4 +1,5 @@
 ---
+title: Installing Addons
 ---

 ## Overview
@@ -7,16 +8,21 @@ Add-ons extend the functionality of Kubernetes.

 This page lists some of the available add-ons and links to their respective installation instructions.

+Add-ons in each section are sorted alphabetically - the ordering does not imply any preferential status.
+
 ## Networking and Network Policy

-* [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database.
-* [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) is a secure L3 networking and network policy provider.
+* [Calico](http://docs.projectcalico.org/v2.0/getting-started/kubernetes/installation/hosted/) is a secure L3 networking and network policy provider.
 * [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy.
+* [Contiv](http://contiv.github.io) provides configurable networking (native L3 using BGP, overlay using vxlan, classic L2, and Cisco-SDN/ACI) for various use cases and a rich policy framework. Contiv project is fully [open sourced](http://github.com/contiv). The [installer](http://github.com/contiv/install) provides both kubeadm and non-kubeadm based installation options.
+* [Flannel](https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml) is an overlay network provider that can be used with Kubernetes.
+* [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API](/docs/user-guide/networkpolicies/). Kubeadm add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize).
+* [Weave Net](https://www.weave.works/docs/net/latest/kube-addon/) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database.

 ## Visualization &amp; Control

-* [Weave Scope](https://www.weave.works/documentation/scope-latest-installing/#k8s) is a tool for graphically visualizing your containers, pods, services etc. Use it in conjunction with a [Weave Cloud account](https://cloud.weave.works/) or host the UI yourself.
 * [Dashboard](https://github.com/kubernetes/dashboard#kubernetes-dashboard) is a dashboard web interface for Kubernetes.
+* [Weave Scope](https://www.weave.works/documentation/scope-latest-installing/#k8s) is a tool for graphically visualizing your containers, pods, services etc. Use it in conjunction with a [Weave Cloud account](https://cloud.weave.works/) or host the UI yourself.

 ## Legacy Add-ons

@@ -6,7 +6,7 @@ assignees:
 - erictune
 - janetkuo
 - thockin
-
+title: Using Admission Controllers
 ---

 * TOC
@@ -87,7 +87,7 @@ The ImagePolicyWebhook plug-in allows a backend webhook to make admission decisi
 ```

 #### Configuration File Format
-ImagePolicyWebhook uses the admission controller config file (`--admission-controller-config-file`) to set configuration options for the behavior of the backend. This file may be json or yaml and has the following format:
+ImagePolicyWebhook uses the admission config file `--admission-controller-config-file` to set configuration options for the behavior of the backend. This file may be json or yaml and has the following format:

 ```javascript
 {
@@ -101,7 +101,7 @@ ImagePolicyWebhook uses the admission controller config file (`--admission-contr
 }
 ```

-The config file must reference a [kubeconfig](/docs/user-guide/kubeconfig-file/) formatted file which sets up the connection to the backend. It is required that the backend communicate over TLS.
+The config file must reference a [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) formatted file which sets up the connection to the backend. It is required that the backend communicate over TLS.

 The kubeconfig file's cluster field must point to the remote service, and the user field must contain the returned authorizer.

@@ -120,13 +120,13 @@ users:
    client-certificate: /path/to/cert.pem # cert for the webhook plugin to use
    client-key: /path/to/key.pem          # key matching the cert
 ```
-For additional HTTP configuration, refer to the [kubeconfig](/docs/user-guide/kubeconfig-file/) documentation.
+For additional HTTP configuration, refer to the [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) documentation.

 #### Request Payloads

 When faced with an admission decision, the API Server POSTs a JSON serialized api.imagepolicy.v1alpha1.ImageReview object describing the action. This object contains fields describing the containers being admitted, as well as any pod annotations that match `*.image-policy.k8s.io/*`.

-Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for alpha objects and check the “apiVersion” field of the request to ensure correct deserialization. Additionally, the API Server must enable the imagepolicy.k8s.io/v1alpha1 API extensions group (`--runtime-config=imagepolicy.k8s.io/v1alpha1=true`).
+Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for alpha objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the imagepolicy.k8s.io/v1alpha1 API extensions group (`--runtime-config=imagepolicy.k8s.io/v1alpha1=true`).

 An example request body:

@@ -151,7 +151,7 @@ An example request body:
 }
 ```

-The remote service is expected to fill the ImageReviewStatus field of the request and respond to either allow or disallow access. The response body’s “spec” field is ignored and may be omitted. A permissive response would return:
+The remote service is expected to fill the ImageReviewStatus field of the request and respond to either allow or disallow access. The response body's "spec" field is ignored and may be omitted. A permissive response would return:

 ```
 {
@@ -252,6 +252,11 @@ This plugin ignores any `PersistentVolumeClaim` updates, it acts only on creatio
 See [persistent volume](/docs/user-guide/persistent-volumes) documentation about persistent volume claims and
 storage classes and how to mark a storage class as default.

+### DefaultTolerationSeconds
+
+This plug-in sets the default forgiveness toleration for pods, which have no forgiveness tolerations, to tolerate
+the taints `notready:NoExecute` and `unreachable:NoExecute` for 5 minutes.
+
 ## Is there a recommended set of plug-ins to use?

 Yes.
@@ -1,392 +1,9 @@
 ---
 assignees:
 - stclair
-
+title: AppArmor
 ---

-AppArmor is a Linux kernel enhancement that can reduce the potential attack surface of an
-application and provide greater defense in depth for Applications. Beta support for AppArmor was
-added in Kubernetes v1.4.
+{% include user-guide-content-moved.md %}

-* TOC
-{:toc}
-
-## What is AppArmor
-
-AppArmor is a Linux kernel security module that supplements the standard Linux user and group based
-permissions to confine programs to a limited set of resources. AppArmor can be configured for any
-application to reduce its potential attack surface and provide greater defense in depth. It is
-configured through profiles tuned to whitelist the access needed by a specific program or container,
-such as Linux capabilities, network access, file permissions, etc. Each profile can be run in either
-enforcing mode, which blocks access to disallowed resources, or complain mode, which only reports
-violations.
-
-AppArmor can help you to run a more secure deployment by restricting what containers are allowed to
-do, and /or providing better auditing through system logs. However, it is important to keep in mind
-that AppArmor is not a silver bullet, and can only do so much to protect against exploits in your
-application code. It is important to provide good, restrictive profiles, and harden your
-applications and cluster from other angles as well.
-
-AppArmor support in Kubernetes is currently in beta.
-
-## Prerequisites
-
-1. **Kubernetes version is at least v1.4**. Kubernetes support for AppArmor was added in
-   v1.4. Kubernetes components older than v1.4 are not aware of the new AppArmor annotations, and
-   will **silently ignore** any AppArmor settings that are provided. To ensure that your Pods are
-   receiving the expected protections, it is important to verify the Kubelet version of your nodes:
-
-        $ kubectl get nodes -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.status.nodeInfo.kubeletVersion}\n{end}'
-        gke-test-default-pool-239f5d02-gyn2: v1.4.0
-        gke-test-default-pool-239f5d02-x1kf: v1.4.0
-        gke-test-default-pool-239f5d02-xwux: v1.4.0
-
-2. **AppArmor kernel module is enabled**. For the Linux kernel to enforce an AppArmor profile, the
-   AppArmor kernel module must be installed and enabled. Several distributions enable the module by
-   default, such as Ubuntu and SUSE, and many others provide optional support. To check whether the
-   module is enabled, check the `/sys/module/apparmor/parameters/enabled` file:
-
-        $ cat /sys/module/apparmor/parameters/enabled
-        Y
-
-    If the Kubelet contains AppArmor support (>= v1.4), it will refuse to run a Pod with AppArmor
-    options if the kernel module is not enabled.
-
-    *Note: Ubuntu carries many AppArmor patches that have not been merged into the upstream Linux
-     kernel, including patches that add additional hooks and features. Kubernetes has only been
-     tested with the upstream version, and does not promise support for other features.*
-
-3. **Container runtime is Docker**. Currently the only Kubernetes-supported container runtime that
-   also supports AppArmor is Docker. As more runtimes add AppArmor support, the options will be
-   expanded. You can verify that your nodes are running docker with:
-
-        $ kubectl get nodes -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {@.status.nodeInfo.containerRuntimeVersion}\n{end}'
-        gke-test-default-pool-239f5d02-gyn2: docker://1.11.2
-        gke-test-default-pool-239f5d02-x1kf: docker://1.11.2
-        gke-test-default-pool-239f5d02-xwux: docker://1.11.2
-
-    If the Kubelet contains AppArmor support (>= v1.4), it will refuse to run a Pod with AppArmor
-    options if the runtime is not Docker.
-
-4. **Profile is loaded**. AppArmor is applied to a Pod by specifying an AppArmor profile that each
-   container should be run with. If any of the specified profiles is not already loaded in the
-   kernel, the Kubelet (>= v1.4) will reject the Pod. You can view which profiles are loaded on a
-   node by checking the `/sys/kernel/security/apparmor/profiles` file. For example:
-
-        $ ssh gke-test-default-pool-239f5d02-gyn2 "sudo cat /sys/kernel/security/apparmor/profiles | sort"
-        apparmor-test-deny-write (enforce)
-        apparmor-test-audit-write (enforce)
-        docker-default (enforce)
-        k8s-nginx (enforce)
-
-    For more details on loading profiles on nodes, see
-    [Setting up nodes with profiles](#setting-up-nodes-with-profiles).
-
-As long as the Kubelet version includes AppArmor support (>= v1.4), the Kubelet will reject a Pod
-with AppArmor options if any of the prerequisites are not met. You can also verify AppArmor support
-on nodes by checking the node ready condition message (though this is likely to be removed in a
-later release):
-
-    $ kubectl get nodes -o=jsonpath=$'{range .items[*]}{@.metadata.name}: {.status.conditions[?(@.reason=="KubeletReady")].message}\n{end}'
-    gke-test-default-pool-239f5d02-gyn2: kubelet is posting ready status. AppArmor enabled
-    gke-test-default-pool-239f5d02-x1kf: kubelet is posting ready status. AppArmor enabled
-    gke-test-default-pool-239f5d02-xwux: kubelet is posting ready status. AppArmor enabled
-
-## Securing a Pod
-
-*Note: AppArmor is currently in beta, so options are specified as annotations. Once support graduates to
-general availability, the annotations will be replaced with first-class fields (more details in
-[Upgrade path to GA](#upgrade-path-to-general-availability)).*
-
-AppArmor profiles are specified *per-container*. To specify the AppArmor profile to run a Pod
-container with, add an annotation to the Pod's metadata:
-
-    container.apparmor.security.beta.kubernetes.io/<container_name>: <profile_ref>
-
-Where `<container_name>` is the name of the container to apply the profile to, and `<profile_ref>`
-specifies the profile to apply. The `profile_ref` can be one of:
-
- `runtime/default` to apply the runtime's default profile.
- `localhost/<profile_name>` to apply the profile loaded on the host with the name `<profile_name>`
-
-See the [API Reference](#api-reference) for the full details on the annotation and profile name formats.
-
-The Kubernetes AppArmor enforcement works by first checking that all the prerequisites have been
-met, and then forwarding the profile selection to the container runtime for enforcement. If the
-prerequisites have not been met, the Pod will be rejected, and will not run.
-
-To verify that the profile was applied, you can expect to see the AppArmor security option listed in the container created event:
-
-    $ kubectl get events | grep Created
-    22s        22s         1         hello-apparmor     Pod       spec.containers{hello}   Normal    Created     {kubelet e2e-test-stclair-minion-group-31nt}   Created container with docker id 269a53b202d3; Security:[seccomp=unconfined apparmor=k8s-apparmor-example-deny-write]
-
-You can also verify directly that the container's root process is running with the correct profile by checking its proc attr:
-
-    $ kubectl exec <pod_name> cat /proc/1/attr/current
-    k8s-apparmor-example-deny-write (enforce)
-
-## Example
-
-In this example you'll see:
-
- One way to load a profile on a node
- How to enforce the profile on a Pod
- How to check that the profile is loaded
- What happens when a profile is violated
- What happens when a profile cannot be loaded
-
-*This example assumes you have already set up a cluster with AppArmor support.*
-
-First, we need to load the profile we want to use onto our nodes. The profile we'll use simply
-denies all file writes:
-
-{% include code.html language="text" file="deny-write.profile" ghlink="/docs/admin/apparmor/deny-write.profile" %}
-
-Since we don't know where the Pod will be scheduled, we'll need to load the profile on all our
-nodes. For this example we'll just use SSH to install the profiles, but other approaches are
-discussed in [Setting up nodes with profiles](#setting-up-nodes-with-profiles).
-
-    $ NODES=(
-        # The SSH-accessible domain names of your nodes
-        gke-test-default-pool-239f5d02-gyn2.us-central1-a.my-k8s
-        gke-test-default-pool-239f5d02-x1kf.us-central1-a.my-k8s
-        gke-test-default-pool-239f5d02-xwux.us-central1-a.my-k8s)
-    $ for NODE in ${NODES[*]}; do ssh $NODE 'sudo apparmor_parser -q <<EOF
-    #include <tunables/global>
-
-    profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
-      #include <abstractions/base>
-
-      file,
-
-      # Deny all file writes.
-      deny /** w,
-    }
-    EOF'
-    done
-
-Next, we'll run a simple "Hello AppArmor" pod with the deny-write profile:
-
-{% include code.html language="yaml" file="hello-apparmor-pod.yaml" ghlink="/docs/admin/apparmor/hello-apparmor-pod.yaml" %}
-
-    $ kubectl create -f /dev/stdin <<EOF
-    apiVersion: v1
-    kind: Pod
-    metadata:
-      name: hello-apparmor
-      annotations:
-        container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-deny-write
-    spec:
-      containers:
-      - name: hello
-        image: busybox
-        command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
-    EOF
-    pod "hello-apparmor" created
-
-If we look at the pod events, we can see that the Pod container was created with the AppArmor
-profile "k8s-apparmor-example-deny-write":
-
-    $ kubectl get events | grep hello-apparmor
-    14s        14s         1         hello-apparmor   Pod                                Normal    Scheduled   {default-scheduler }                           Successfully assigned hello-apparmor to gke-test-default-pool-239f5d02-gyn2
-    14s        14s         1         hello-apparmor   Pod       spec.containers{hello}   Normal    Pulling     {kubelet gke-test-default-pool-239f5d02-gyn2}   pulling image "busybox"
-    13s        13s         1         hello-apparmor   Pod       spec.containers{hello}   Normal    Pulled      {kubelet gke-test-default-pool-239f5d02-gyn2}   Successfully pulled image "busybox"
-    13s        13s         1         hello-apparmor   Pod       spec.containers{hello}   Normal    Created     {kubelet gke-test-default-pool-239f5d02-gyn2}   Created container with docker id 06b6cd1c0989; Security:[seccomp=unconfined apparmor=k8s-apparmor-example-deny-write]
-    13s        13s         1         hello-apparmor   Pod       spec.containers{hello}   Normal    Started     {kubelet gke-test-default-pool-239f5d02-gyn2}   Started container with docker id 06b6cd1c0989
-
-We can verify that the container is actually running with that profile by checking its proc attr:
-
-    $ kubectl exec hello-apparmor cat /proc/1/attr/current
-    k8s-apparmor-example-deny-write (enforce)
-
-Finally, we can see what happens if we try to violate the profile by writing to a file:
-
-    $ kubectl exec hello-apparmor touch /tmp/test
-    touch: /tmp/test: Permission denied
-    error: error executing remote command: command terminated with non-zero exit code: Error executing in Docker Container: 1
-
-To wrap up, let's look at what happens if we try to specify a profile that hasn't been loaded:
-
-    $ kubectl create -f /dev/stdin <<EOF
-    apiVersion: v1
-    kind: Pod
-    metadata:
-      name: hello-apparmor-2
-      annotations:
-        container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-allow-write
-    spec:
-      containers:
-      - name: hello
-        image: busybox
-        command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
-    EOF
-    pod "hello-apparmor-2" created
-    
-    $ kubectl describe pod hello-apparmor-2
-    Name:		hello-apparmor-2
-    Namespace:	default
-    Node:		gke-test-default-pool-239f5d02-x1kf/
-    Start Time:	Tue, 30 Aug 2016 17:58:56 -0700
-    Labels:		<none>
-    Status:		Failed
-    Reason:		AppArmor
-    Message:	Pod Cannot enforce AppArmor: profile "k8s-apparmor-example-allow-write" is not loaded
-    IP:		
-    Controllers:	<none>
-    Containers:
-      hello:
-        Image:	busybox
-        Port:	
-        Command:
-          sh
-          -c
-          echo 'Hello AppArmor!' && sleep 1h
-        Requests:
-          cpu:			100m
-        Environment Variables:	<none>
-    Volumes:
-      default-token-dnz7v:
-        Type:	Secret (a volume populated by a Secret)
-        SecretName:	default-token-dnz7v
-    QoS Tier:	Burstable
-    Events:
-      FirstSeen	LastSeen	Count	From						SubobjectPath	Type		Reason		Message
-      ---------	--------	-----	----						-------------	--------	------		-------
-      23s		23s		1	{default-scheduler }						Normal		Scheduled	Successfully assigned hello-apparmor-2 to e2e-test-stclair-minion-group-t1f5
-      23s		23s		1	{kubelet e2e-test-stclair-minion-group-t1f5}			Warning		AppArmor	Cannot enforce AppArmor: profile "k8s-apparmor-example-allow-write" is not loaded
-
-Note the pod status is Failed, with a helpful error message: `Pod Cannot enforce AppArmor: profile
-"k8s-apparmor-example-allow-write" is not loaded`. An event was also recorded with the same message.
-
-## Administration
-
-### Setting up nodes with profiles
-
-Kubernetes does not currently provide any native mechanisms for loading AppArmor profiles onto
-nodes. There are lots of ways to setup the profiles though, such as:
-
- Through a [DaemonSet](../daemons/) that runs a Pod on each node to
-  ensure the correct profiles are loaded. An example implementation can be found
-  [here](https://github.com/kubernetes/contrib/tree/master/apparmor/loader).
- At node initialization time, using your node initialization scripts (e.g. Salt, Ansible, etc.) or
-  image.
- By copying the profiles to each node and loading them through SSH, as demonstrated in the
-  [Example](#example).
-
-The scheduler is not aware of which profiles are loaded onto which node, so the full set of profiles
-must be loaded onto every node.  An alternative approach is to add a node label for each profile (or
-class of profiles) on the node, and use a
-[node selector](../../user-guide/node-selection/) to ensure the Pod is run on a
-node with the required profile.
-
-### Restricting profiles with the PodSecurityPolicy
-
-If the PodSecurityPolicy extension is enabled, cluster-wide AppArmor restrictions can be applied. To
-enable the PodSecurityPolicy, two flags must be set on the `apiserver`:
-
-    --admission-control=PodSecurityPolicy[,others...]
-    --runtime-config=extensions/v1beta1/podsecuritypolicy[,others...]
-
-With the extension enabled, the AppArmor options can be specified as annotations on the PodSecurityPolicy:
-
-    apparmor.security.beta.kubernetes.io/defaultProfileName: <profile_ref>
-    apparmor.security.beta.kubernetes.io/allowedProfileNames: <profile_ref>[,others...]
-
-The default profile name option specifies the profile to apply to containers by default when none is
-specified. The allowed profile names option specifies a list of profiles that Pod containers are
-allowed to be run with. If both options are provided, the default must be allowed. The profiles are
-specified in the same format as on containers. See the [API Reference](#api-reference) for the full
-specification.
-
-### Disabling AppArmor
-
-If you do not want AppArmor to be available on your cluster, it can be disabled by a command-line flag:
-
-    --feature-gates=AppArmor=false
-
-When disabled, any Pod that includes an AppArmor profile will fail validation with a "Forbidden"
-error. Note that by default docker always enables the "docker-default" profile on non-privileged
-pods (if the AppArmor kernel module is enabled), and will continue to do so even if the feature-gate
-is disabled. The option to disable AppArmor will be removed when AppArmor graduates to general
-availability (GA).
-
-### Upgrading to Kubernetes v1.4 with AppArmor
-
-No action is required with respect to AppArmor to upgrade your cluster to v1.4. However, if any
-existing pods had an AppArmor annotation, they will not go through validation (or PodSecurityPolicy
-admission). If permissive profiles are loaded on the nodes, a malicious user could pre-apply a
-permissive profile to escalate the pod privileges above the docker-default. If this is a concern, it
-is recommended to scrub the cluster of any pods containing an annotation with
-`apparmor.security.beta.kubernetes.io`.
-
-### Upgrade path to General Availability
-
-When AppArmor is ready to be graduated to general availability (GA), the options currently specified
-through annotations will be converted to fields. Supporting all the upgrade and downgrade paths
-through the transition is very nuanced, and will be explained in detail when the transition
-occurs. We will commit to supporting both fields and annotations for at least 2 releases, and will
-explicitly reject the annotations for at least 2 releases after that.
-
-## Authoring Profiles
-
-Getting AppArmor profiles specified correctly can be a tricky business. Fortunately there are some
-tools to help with that:
-
- `aa-genprof` and `aa-logprof` generate profile rules by monitoring an application's activity and
-  logs, and admitting the actions it takes. Further instructions are provided by the
-  [AppArmor documentation](http://wiki.apparmor.net/index.php/Profiling_with_tools).
- [bane](https://github.com/jfrazelle/bane) is an AppArmor profile generator for Docker that uses a
-  simplified profile language.
-
-It is recommended to run your application through Docker on a development workstation to generate
-the profiles, but there is nothing preventing running the tools on the Kubernetes node where your
-Pod is running.
-
-To debug problems with AppArmor, you can check the system logs to see what, specifically, was
-denied. AppArmor logs verbose messages to `dmesg`, and errors can usually be found in the system
-logs or through `journalctl`. More information is provided in
-[AppArmor failures](http://wiki.apparmor.net/index.php/AppArmor_Failures).
-
-Additional resources:
-
- http://wiki.apparmor.net/index.php/QuickProfileLanguage
- http://wiki.apparmor.net/index.php/ProfileLanguage
-
-## API Reference
-
-**Pod Annotation**:
-
-Specifying the profile a container will run with:
-
- **key**: `container.apparmor.security.beta.kubernetes.io/<container_name>`
-  Where `<container_name>` matches the name of a container in the Pod.
-  A separate profile can be specified for each container in the Pod.
- **value**: a profile reference, described below
-
-**Profile Reference**:
-
- `runtime/default`: Refers to the default runtime profile.
-  - Equivalent to not specifying a profile (without a PodSecurityPolicy default), except it still
-    requires AppArmor to be enabled.
-  - For Docker, this resolves to the
-    [`docker-default`](https://docs.docker.com/engine/security/apparmor/) profile for non-privileged
-    containers, and unconfined (no profile) for privileged containers.
- `localhost/<profile_name>`: Refers to a profile loaded on the node (localhost) by name.
-  - The possible profile names are detailed in the
-    [core policy reference](http://wiki.apparmor.net/index.php/AppArmor_Core_Policy_Reference#Profile_names_and_attachment_specifications)
-
-Any other profile reference format is invalid.
-
-**PodSecurityPolicy Annotations**
-
-Specifying the default profile to apply to containers when none is provided:
-
- **key**: `apparmor.security.beta.kubernetes.io/defaultProfileName`
- **value**: a profile reference, described above
-
-Specifying the list of profiles Pod containers are allowed to specify:
-
- **key**: `apparmor.security.beta.kubernetes.io/allowedProfileNames`
- **value**: a comma-separated list of profile references (described above)
-  - Although an escaped comma is a legal character in a profile name, it cannot be explicitly
-    allowed here
+[AppArmor](/docs/tutorials/clusters/apparmor/)
@@ -2,68 +2,9 @@
 assignees:
 - soltysh
 - sttts
-
+title: Audit in Kubernetes
 ---

-* TOC
-{:toc}
+{% include user-guide-content-moved.md %}

-## Audit in Kubernetes
-
-Kubernetes Audit provides a security-relevant chronological set of records documenting
-the sequence of activities that have affected system by individual users, administrators
-or other components of the system. It allows cluster administrator to
-answer the following questions:
-    - what happened?
-    - when did it happen?
-    - who initiated it?
-    - on what did it happen?
-    - where was it observed?
-    - from where was it initiated?
-    - to where was it going?
-
-NOTE: Currently, Kubernetes provides only basic audit capabilities, there is still a lot
-of work going on to provide fully featured auditing capabilities (see https://github.com/kubernetes/features/issues/22).
-
-Kubernetes audit is part of [kube-apiserver](/docs/admin/kube-apiserver) logging all requests
-coming to the server. Each audit log contains two entries:
-
-1. The request line containing:
-    - unique id allowing to match the response line (see 2)
-    - source ip of the request
-    - HTTP method being invoked
-    - original user invoking the operation
-    - impersonated user for the operation
-    - namespace of the request or <none>
-    - URI as requested
-2. The response line containing:
-    - the unique id from 1
-    - response code
-
-Example output for user `admin` asking for a list of pods:
-
-```
-2016-09-07T13:03:57.400333046Z AUDIT: id="5c3b8227-4af9-4322-8a71-542231c3887b" ip="127.0.0.1" method="GET" user="admin" as="<self>" namespace="default" uri="/api/v1/namespaces/default/pods"
-2016-09-07T13:03:57.400710987Z AUDIT: id="5c3b8227-4af9-4322-8a71-542231c3887b" response="200"
-```
-
-NOTE: The audit capabilities are available *only* for the secured endpoint of the API server.
-
-## Configuration
-
-[Kube-apiserver](/docs/admin/kube-apiserver) provides following options which are responsible
-for configuring where and how audit logs are handled:
-
- `audit-log-path` - enables the audit log pointing to a file where the requests are being logged to.
- `audit-log-maxage` - specifies maximum number of days to retain old audit log files based on the timestamp encoded in their filename.
- `audit-log-maxbackup` - specifies maximum number of old audit log files to retain.
- `audit-log-maxsize` - specifies maximum size in megabytes of the audit log file before it gets rotated. Defaults to 100MB
-
-If an audit log file already exists, Kubernetes appends new audit logs to that file.
-Otherwise, Kubernetes creates an audit log file at the location you specified in
-`audit-log-path`. If the audit log file exceeds the size you specify in `audit-log-maxsize`,
-Kubernetes will rename the current log file by appending the current timestamp on
-the file name (before the file extension) and create a new audit log file.
-Kubernetes may delete old log files when creating a new log file; you can configure
-how many files are retained and how old they can be by specifying the `audit-log-maxbackup`
-and `audit-log-maxage` options.
+[Auditing](/docs/concepts/cluster-administration/audit/)
@@ -4,9 +4,12 @@ assignees:
 - lavalamp
 - ericchiang
 - deads2k
-
+- liggitt
+title: Authenticating
 ---

+* TOC
+{:toc}

 ## Users in Kubernetes

@@ -25,16 +28,17 @@ manually through API calls. Service accounts are tied to a set of credentials
 stored as `Secrets`, which are mounted into pods allowing in cluster processes
 to talk to the Kubernetes API.

-All API requests are tied to either a normal user or a service account. This
-means every process inside or outside the cluster, from a human user typing
-`kubectl` on a workstation, to `kubelets` on nodes, to members of the control
-plane, must authenticate when making requests to the the API server.
+API requests are tied to either a normal user or a service account, or are treated
+as anonymous requests. This means every process inside or outside the cluster, from
+a human user typing `kubectl` on a workstation, to `kubelets` on nodes, to members
+of the control plane, must authenticate when making requests to the API server,
+or be treated as an anonymous user.

 ## Authentication strategies

-Kubernetes uses client certificates, bearer tokens, or HTTP basic auth to
-authenticate API requests through authentication plugins. As HTTP request are
-made to the API server plugins attempts to associate the following attributes
+Kubernetes uses client certificates, bearer tokens, an authenticating proxy, or HTTP basic auth to
+authenticate API requests through authentication plugins. As HTTP requests are
+made to the API server, plugins attempt to associate the following attributes
 with the request:

 * Username: a string which identifies the end user. Common values might be `kube-admin` or `jane@example.com`.
@@ -54,32 +58,54 @@ When multiple are enabled, the first authenticator module
 to successfully authenticate the request short-circuits evaluation.
 The API server does not guarantee the order authenticators run in.

+The `system:authenticated` group is included in the list of groups for all authenticated users.
+
 ### X509 Client Certs

 Client certificate authentication is enabled by passing the `--client-ca-file=SOMEFILE`
 option to API server. The referenced file must contain one or more certificates authorities
 to use to validate client certificates presented to the API server. If a client certificate
 is presented and verified, the common name of the subject is used as the user name for the
-request.
+request. As of Kubernetes 1.4, client certificates can also indicate a user's group memberships
+using the certificate's organization fields. To include multiple group memberships for a user,
+include multiple organization fields in the certificate.
+
+For example, using the `openssl` command line tool to generate a certificate signing request:
+
+``` bash
+openssl req -new -key jbeda.pem -out jbeda-csr.pem -subj "/CN=jbeda/O=app1/O=app2"
+```
+
+This would create a CSR for the username "jbeda", belonging to two groups, "app1" and "app2".

 See [APPENDIX](#appendix) for how to generate a client cert.

 ### Static Token File

-Token file is enabled by passing the `--token-auth-file=SOMEFILE` option to the
-API server.  Currently, tokens last indefinitely, and the token list cannot be
+The API server reads bearer tokens from a file when given the `--token-auth-file=SOMEFILE` option on the command line.  Currently, tokens last indefinitely, and the token list cannot be
 changed without restarting API server.

-The token file format is implemented in `plugin/pkg/auth/authenticator/token/tokenfile/...`
-and is a csv file with a minimum of 3 columns: token, user name, user uid, followed by
-optional group names. Note, if you have more than one group the column must be double quoted e.g.
+The token file is a csv file with a minimum of 3 columns: token, user name, user uid,
+followed by optional group names. Note, if you have more than one group the column must be
+double quoted e.g.

 ```conf
 token,user,uid,"group1,group2,group3"
 ```

-When using token authentication from an http client the API server expects an `Authorization`
-header with a value of `Bearer SOMETOKEN`.
+#### Putting a Bearer Token in a Request
+
+When using bearer token authentication from an http client, the API
+server expects an `Authorization` header with a value of `Bearer
+THETOKEN`.  The bearer token must be a character sequence that can be
+put in an HTTP header value using no more than the encoding and
+quoting facilities of HTTP.  For example: if the bearer token is
+`31ada4fd-adec-460c-809a-9e56ceb75269` then it would appear in an HTTP
+header as shown below.
+
+```http
+Authorization: Bearer 31ada4fd-adec-460c-809a-9e56ceb75269
+```

 ### Static Password File

@@ -89,11 +115,12 @@ and the password cannot be changed without restarting API server. Note that basi
 authentication is currently supported for convenience while we finish making the
 more secure modes described above easier to use.

-The basic auth file format is implemented in `plugin/pkg/auth/authenticator/password/passwordfile/...`
-and is a csv file with 3 columns: password, user name, user id.
+The basic auth file is a csv file with a minimum of 3 columns: password,
+user name, user id, followed by optional group names. Note, if you have more than
+one group the column must be double quoted e.g.

 ```conf
-password,user,uid
+password,user,uid,"group1,group2,group3"
 ```

 When using basic authentication from an http client, the API server expects an `Authorization` header
@@ -171,7 +198,8 @@ type: kubernetes.io/service-account-token
 Note: values are base64 encoded because secrets are always base64 encoded.

 The signed JWT can be used as a bearer token to authenticate as the given service
-account. Normally these secrets are mounted into pods for in-cluster access to
+account. See [above](#putting-a-bearer-token-in-a-request) for how the token is included
+in a request.  Normally these secrets are mounted into pods for in-cluster access to
 the API server, but can be used from outside the cluster as well.

 Service accounts authenticate with the username `system:serviceaccount:(NAMESPACE):(SERVICEACCOUNT)`,
@@ -192,50 +220,137 @@ email, signed by the server.

 To identify the user, the authenticator uses the `id_token` (not the `access_token`)
 from the OAuth2 [token response](https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse)
-as a bearer token.
+as a bearer token.  See [above](#putting-a-bearer-token-in-a-request) for how the token
+is included in a request.
+
+![Kubernetes OpenID Connect Flow](/images/docs/admin/k8s_oidc_login.svg)
+
+1.  Login to your identity provider
+2.  Your identity provider will provide you with an `access_token`, `id_token` and a `refresh_token`
+3.  When using `kubectl`, use your `id_token` with the `--token` flag or add it directly to your `kubeconfig`
+4.  `kubectl` sends your `id_token` in a header called Authorization to the API server
+5.  The API server will make sure the JWT signature is valid by checking against the certificate named in the configuration
+6.  Check to make sure the `id_token` hasn't expired
+7.  Make sure the user is authorized
+8.  Once authorized the API server returns a response to `kubectl`
+9.  `kubectl` provides feedback to the user
+
+Since all of the data needed to validate who you are is in the `id_token`, Kubernetes doesn't need to
+"phone home" to the identity provider.  In a model where every request is stateless this provides a very scalable
+solution for authentication.  It does offer a few challenges:
+
+1.  Kubernetes has no "web interface" to trigger the authentication process.  There is no browser or interface to collect credentials which is why you need to authenticate to your identity provider first.
+2.  The `id_token` can't be revoked, its like a certificate so it should be short-lived (only a few minutes) so it can be very annoying to have to get a new token every few minutes
+3.  There's no easy way to authenticate to the Kubernetes dashboard without using the `kubectl -proxy` command or a reverse proxy that injects the `id_token`
+
+
+#### Configuring the API Server
+
+To enable the plugin, configure the following flags on the API server:
+
+| Parameter | Description | Example | Required |
+| --------- | ----------- | ------- | ------- |
+| `--oidc-issuer-url` | URL of the provider which allows the API server to discover public signing keys. Only URLs which use the `https://` scheme are accepted.  This is typically the provider's discovery URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com".  This URL should point to the level below .well-known/openid-configuration | If the discovery URL is https://accounts.google.com/.well-known/openid-configuration the value should be https://accounts.google.com | Yes |
+| `--oidc-client-id` |  A client id that all tokens must be issued for. | kubernetes | Yes |
+| `--oidc-username-claim` | JWT claim to use as the user name. By default `sub`, which is expected to be a unique identifier of the end user. Admins can choose other claims, such as `email` or `name`, depending on their provider. However, claims other than `email` will be prefixed with the issuer URL to prevent naming clashes with other plugins. | sub | No |
+| `--oidc-groups-claim` | JWT claim to use as the user's group. If the claim is present it must be an array of strings. | groups | No |
+| `--oidc-ca-file` | The path to the certificate for the CA that signed your identity provider's web certificate.  Defaults to the host's root CAs. | `/etc/kubernetes/ssl/kc-ca.pem` | No |
+
+If a claim other than `email` is chosen for `--oidc-username-claim`, the value
+will be prefixed with the `--oidc-issuer-url` to prevent clashes with existing
+Kubernetes names (such as the `system:` users). For example, if the provider
+URL is `https://accounts.google.com` and the username claim maps to `jane`, the
+plugin will authenticate the user as:

 ```
-Authentication: Bearer (id_token)
+https://accounts.google.com#jane
 ```

-To enable the plugin, pass the following required flags:
-
-* `--oidc-issuer-url` URL of the provider which allows the API server to discover
-public signing keys. Only URLs which use the `https://` scheme are accepted.  This is typically
-the provider's URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com".
-
-* `--oidc-client-id` A client id that all tokens must be issued for.
-
 Importantly, the API server is not an OAuth2 client, rather it can only be
-configured to trust a single client. This allows the use of public providers,
+configured to trust a single issuer. This allows the use of public providers,
 such as Google, without trusting credentials issued to third parties. Admins who
-wish utilize multiple OAuth clients should explore providers which support the
+wish to utilize multiple OAuth clients should explore providers which support the
 `azp` (authorized party) claim, a mechanism for allowing one client to issue
 tokens on behalf of another.

-The plugin also accepts the following optional flags:
-
-* `--oidc-ca-file` Used by the API server to establish and verify the secure
-connection to the issuer. Defaults to the host's root CAs.
-
-And experimental flags:
-
-* `--oidc-username-claim` JWT claim to use as the user name. By default `sub`,
-which is expected to be a unique identifier of the end user. Admins can choose
-other claims, such as `email`, depending on their provider.
-* `--oidc-groups-claim` JWT claim to use as the user's group. If the claim is present
-it must be an array of strings.
-
 Kubernetes does not provide an OpenID Connect Identity Provider.
 You can use an existing public OpenID Connect Identity Provider (such as Google, or [others](http://connect2id.com/products/nimbus-oauth-openid-connect-sdk/openid-connect-providers)).
-Or, you can run your own Identity Provider, such as CoreOS [dex](https://github.com/coreos/dex), [Keycloak](https://github.com/keycloak/keycloak) or CloudFoundary [UAA](https://github.com/cloudfoundry/uaa).
+Or, you can run your own Identity Provider, such as CoreOS [dex](https://github.com/coreos/dex), [Keycloak](https://github.com/keycloak/keycloak), CloudFoundry [UAA](https://github.com/cloudfoundry/uaa), or Tremolo Security's [OpenUnison](https://github.com/tremolosecurity/openunison).

-The provider needs to support [OpenID connect discovery](https://openid.net/specs/openid-connect-discovery-1_0.html); not all do.
+For an identity provider to work with Kubernetes it must:
+
+1.  Support [OpenID connect discovery](https://openid.net/specs/openid-connect-discovery-1_0.html); not all do.
+2.  Run in TLS with non-obsolete ciphers
+3.  Have a CA signed certificate (even if the CA is not a commercial CA or is self signed)
+
+A note about requirement #3 above, requiring a CA signed certificate.  If you deploy your own identity provider (as opposed to one of the cloud providers like Google or Microsoft) you MUST have your identity provider's web server certificate signed by a certificate with the `CA` flag set to `TRUE`, even if it is self signed.  This is due to GoLang's TLS client implementation being very strict to the standards around certificate validation.  If you don't have a CA handy, you can use this script from the CoreOS team to create a simple CA and a signed certificate and key pair - https://github.com/coreos/dex/blob/1ee5920c54f5926d6468d2607c728b71cfe98092/examples/k8s/gencert.sh or this script based on it that will generate SHA256 certs with a longer life and larger key size https://raw.githubusercontent.com/TremoloSecurity/openunison-qs-kubernetes/master/makecerts.sh.

 Setup instructions for specific systems:

 - [UAA](http://apigee.com/about/blog/engineering/kubernetes-authentication-enterprise)
 - [Dex](https://speakerdeck.com/ericchiang/kubernetes-access-control-with-dex)
+- [OpenUnison](https://github.com/TremoloSecurity/openunison-qs-kubernetes)
+
+#### Using kubectl
+
+##### Option 1 - OIDC Authenticator
+
+The first option is to use the `oidc` authenticator.  This authenticator takes your `id_token`, `refresh_token` and your OIDC `client_secret` and will refresh your token automatically.  Once you have authenticated to your identity provider:
+
+```bash
+kubectl config set-credentials USER_NAME \
+   --auth-provider=oidc \
+   --auth-provider-arg=idp-issuer-url=( issuer url ) \
+   --auth-provider-arg=client-id=( your client id ) \
+   --auth-provider-arg=client-secret=( your client secret ) \
+   --auth-provider-arg=refresh-token=( your refresh token ) \
+   --auth-provider-arg=idp-certificate-authority=( path to your ca certificate ) \
+   --auth-provider-arg=id-token=( your id_token ) \
+   --auth-provider-arg=extra-scopes=( comma separated list of scopes to add to "openid email profile", optional )
+```
+
+As an example, running the below command after authenticating to your identity provider:
+
+```bash
+kubectl config set-credentials mmosley  \
+        --auth-provider=oidc  \
+        --auth-provider-arg=idp-issuer-url=https://oidcidp.tremolo.lan:8443/auth/idp/OidcIdP  \
+        --auth-provider-arg=client-id=kubernetes  \
+        --auth-provider-arg=client-secret=1db158f6-177d-4d9c-8a8b-d36869918ec5  \
+        --auth-provider-arg=refresh-token=q1bKLFOyUiosTfawzA93TzZIDzH2TNa2SMm0zEiPKTUwME6BkEo6Sql5yUWVBSWpKUGphaWpxSVAfekBOZbBhaEW+VlFUeVRGcluyVF5JT4+haZmPsluFoFu5XkpXk5BXqHega4GAXlF+ma+vmYpFcHe5eZR+slBFpZKtQA= \
+        --auth-provider-arg=idp-certificate-authority=/root/ca.pem \
+        --auth-provider-arg=extra-scopes=groups \
+        --auth-provider-arg=id-token=eyJraWQiOiJDTj1vaWRjaWRwLnRyZW1vbG8ubGFuLCBPVT1EZW1vLCBPPVRybWVvbG8gU2VjdXJpdHksIEw9QXJsaW5ndG9uLCBTVD1WaXJnaW5pYSwgQz1VUy1DTj1rdWJlLWNhLTEyMDIxNDc5MjEwMzYwNzMyMTUyIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL29pZGNpZHAudHJlbW9sby5sYW46ODQ0My9hdXRoL2lkcC9PaWRjSWRQIiwiYXVkIjoia3ViZXJuZXRlcyIsImV4cCI6MTQ4MzU0OTUxMSwianRpIjoiMm96US15TXdFcHV4WDlHZUhQdy1hZyIsImlhdCI6MTQ4MzU0OTQ1MSwibmJmIjoxNDgzNTQ5MzMxLCJzdWIiOiI0YWViMzdiYS1iNjQ1LTQ4ZmQtYWIzMC0xYTAxZWU0MWUyMTgifQ.w6p4J_6qQ1HzTG9nrEOrubxIMb9K5hzcMPxc9IxPx2K4xO9l-oFiUw93daH3m5pluP6K7eOE6txBuRVfEcpJSwlelsOsW8gb8VJcnzMS9EnZpeA0tW_p-mnkFc3VcfyXuhe5R3G7aa5d8uHv70yJ9Y3-UhjiN9EhpMdfPAoEB9fYKKkJRzF7utTTIPGrSaSU6d2pcpfYKaxIwePzEkT4DfcQthoZdy9ucNvvLoi1DIC-UocFD8HLs8LYKEqSxQvOcvnThbObJ9af71EwmuE21fO5KzMW20KtAeget1gnldOosPtz1G5EwvaQ401-RPQzPGMVBld0_zMCAwZttJ4knw
+```
+
+Which would produce the below configuration:
+
+```yaml
+users:
+- name: mmosley
+  user:
+    auth-provider:
+      config:
+        client-id: kubernetes
+        client-secret: 1db158f6-177d-4d9c-8a8b-d36869918ec5
+        extra-scopes: groups
+        id-token: eyJraWQiOiJDTj1vaWRjaWRwLnRyZW1vbG8ubGFuLCBPVT1EZW1vLCBPPVRybWVvbG8gU2VjdXJpdHksIEw9QXJsaW5ndG9uLCBTVD1WaXJnaW5pYSwgQz1VUy1DTj1rdWJlLWNhLTEyMDIxNDc5MjEwMzYwNzMyMTUyIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL29pZGNpZHAudHJlbW9sby5sYW46ODQ0My9hdXRoL2lkcC9PaWRjSWRQIiwiYXVkIjoia3ViZXJuZXRlcyIsImV4cCI6MTQ4MzU0OTUxMSwianRpIjoiMm96US15TXdFcHV4WDlHZUhQdy1hZyIsImlhdCI6MTQ4MzU0OTQ1MSwibmJmIjoxNDgzNTQ5MzMxLCJzdWIiOiI0YWViMzdiYS1iNjQ1LTQ4ZmQtYWIzMC0xYTAxZWU0MWUyMTgifQ.w6p4J_6qQ1HzTG9nrEOrubxIMb9K5hzcMPxc9IxPx2K4xO9l-oFiUw93daH3m5pluP6K7eOE6txBuRVfEcpJSwlelsOsW8gb8VJcnzMS9EnZpeA0tW_p-mnkFc3VcfyXuhe5R3G7aa5d8uHv70yJ9Y3-UhjiN9EhpMdfPAoEB9fYKKkJRzF7utTTIPGrSaSU6d2pcpfYKaxIwePzEkT4DfcQthoZdy9ucNvvLoi1DIC-UocFD8HLs8LYKEqSxQvOcvnThbObJ9af71EwmuE21fO5KzMW20KtAeget1gnldOosPtz1G5EwvaQ401-RPQzPGMVBld0_zMCAwZttJ4knw
+        idp-certificate-authority: /root/ca.pem
+        idp-issuer-url: https://oidcidp.tremolo.lan:8443/auth/idp/OidcIdP
+        refresh-token: q1bKLFOyUiosTfawzA93TzZIDzH2TNa2SMm0zEiPKTUwME6BkEo6Sql5yUWVBSWpKUGphaWpxSVAfekBOZbBhaEW+VlFUeVRGcluyVF5JT4+haZmPsluFoFu5XkpXk5BXq
+      name: oidc
+```
+Once your `id_token` expires, `kubectl` will attempt to refresh your `id_token` using your `refresh_token` and `client_secret` storing the new values for the `refresh_token` and `id_token` in your `kube/.config`.
+
+
+##### Option 2 - Use the `--token` Option
+
+The `kubectl` command lets you pass in a token using the `--token` option.  Simply copy and paste the `id_token` into this option:
+
+```
+kubectl --token=eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL21sYi50cmVtb2xvLmxhbjo4MDQzL2F1dGgvaWRwL29pZGMiLCJhdWQiOiJrdWJlcm5ldGVzIiwiZXhwIjoxNDc0NTk2NjY5LCJqdGkiOiI2RDUzNXoxUEpFNjJOR3QxaWVyYm9RIiwiaWF0IjoxNDc0NTk2MzY5LCJuYmYiOjE0NzQ1OTYyNDksInN1YiI6Im13aW5kdSIsInVzZXJfcm9sZSI6WyJ1c2VycyIsIm5ldy1uYW1lc3BhY2Utdmlld2VyIl0sImVtYWlsIjoibXdpbmR1QG5vbW9yZWplZGkuY29tIn0.f2As579n9VNoaKzoF-dOQGmXkFKf1FMyNV0-va_B63jn-_n9LGSCca_6IVMP8pO-Zb4KvRqGyTP0r3HkHxYy5c81AnIh8ijarruczl-TK_yF5akjSTHFZD-0gRzlevBDiH8Q79NAr-ky0P4iIXS8lY9Vnjch5MF74Zx0c3alKJHJUnnpjIACByfF2SCaYzbWFMUNat-K1PaUk5-ujMBG7yYnr95xD-63n8CO8teGUAAEMx6zRjzfhnhbzX-ajwZLGwGUBT4WqjMs70-6a7_8gZmLZb2az1cZynkFRj2BaCkVT3A2RrjeEwZEtGXlMqKJ1_I2ulrOVsYx01_yD35-rw get nodes
+```
+

 ### Webhook Token Authentication

@@ -244,7 +359,7 @@ Webhook authentication is a hook for verifying bearer tokens.
 * `--authentication-token-webhook-config-file` a kubeconfig file describing how to access the remote webhook service.
 * `--authentication-token-webhook-cache-ttl` how long to cache authentication decisions. Defaults to two minutes.

-The configuration file uses the [kubeconfig](/docs/user-guide/kubeconfig-file/)
+The configuration file uses the [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/)
 file format. Within the file "users" refers to the API server webhook and
 "clusters" refers to the remote service. An example would be:

@@ -272,10 +387,11 @@ contexts:
  name: webhook
 ```

-When a client attempts to authenticate with the API server using a bearer token,
-using the `Authorization: Bearer (TOKEN)` HTTP header the authentication webhook
+When a client attempts to authenticate with the API server using a bearer token
+as discussed [above](#putting-a-bearer-token-in-a-request),
+the authentication webhook
 queries the remote service with a review object containing the token. Kubernetes
-will not challenge request that lack such a header.
+will not challenge a request that lacks such a header.

 Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/api/)
 as other Kubernetes API objects. Implementers should be aware of looser
@@ -338,6 +454,20 @@ An unsuccessful request would return:

 HTTP status codes can be used to supply additional error context.

+
+### Authenticating Proxy
+
+The API server can be configured to identify users from request header values, such as `X-Remote-User`.
+It is designed for use in combination with an authenticating proxy, which sets the request header value.
+In order to prevent header spoofing, the authenticating proxy is required to present a valid client
+certificate to the API server for validation against the specified CA before the request headers are
+checked.
+
+* `--requestheader-username-headers` Required, case-insensitive. Header names to check, in order, for the user identity. The first header containing a value is used as the identity.
+* `--requestheader-client-ca-file` Required. PEM-encoded certificate bundle. A valid client certificate must be presented and validated against the certificate authorities in the specified file before the request headers are checked for user names.
+* `--requestheader-allowed-names` Optional.  List of common names (cn). If set, a valid client certificate with a Common Name (cn) in the specified list must be presented before the request headers are checked for user names. If empty, any Common Name is allowed.
+
+
 ### Keystone Password

 Keystone authentication is enabled by passing the `--experimental-keystone-url=<AuthURL>`
@@ -345,6 +475,13 @@ option to the API server during startup. The plugin is implemented in
 `plugin/pkg/auth/authenticator/password/keystone/keystone.go` and currently uses
 basic auth to verify used by username and password.

+If you have configured self-signed certificates for the Keystone server,
+you may need to set the `--experimental-keystone-ca-file=SOMEFILE` option when
+starting the Kubernetes API server. If you set the option, the Keystone
+server's certificate is verified by one of the authorities in the
+`experimental-keystone-ca-file`. Otherwise, the certificate is verified by
+the host's root Certificate Authority.
+
 For details on how to use keystone to manage projects and users, refer to the
 [Keystone documentation](http://docs.openstack.org/developer/keystone/). Please
 note that this plugin is still experimental, under active development, and likely
@@ -354,6 +491,22 @@ Please refer to the [discussion](https://github.com/kubernetes/kubernetes/pull/1
 [blueprint](https://github.com/kubernetes/kubernetes/issues/11626) and [proposed
 changes](https://github.com/kubernetes/kubernetes/pull/25536) for more details.

+## Anonymous requests
+
+Anonymous access is enabled by default, and can be disabled by passing `--anonymous-auth=false`
+option to the API server during startup.
+
+When enabled, requests that are not rejected by other configured authentication methods are
+treated as anonymous requests, and given a username of `system:anonymous` and a group of
+`system:unauthenticated`.
+
+For example, on a server with token authentication configured, and anonymous access enabled,
+a request providing an invalid bearer token would receive a `401 Unauthorized` error.
+A request providing no bearer token would be treated as an anonymous request.
+
+If you rely on authentication alone to authorize access, either change to use an
+authorization mode other than `AlwaysAllow`, or set `--anonymous-auth=false`.
+
 ## Plugin Development

 We plan for the Kubernetes API server to issue tokens after the user has been
@@ -367,7 +520,7 @@ enterprise directory, kerberos, etc.)
 ### Creating Certificates

 When using client certificate authentication, you can generate certificates
-using an existing deployment script or manually through `easyrsa` or `openssl.``
+using an existing deployment script or manually through `easyrsa` or `openssl.`

 #### Using an Existing Deployment Script

@@ -382,7 +535,7 @@ The script will generate three files: `ca.crt`, `server.crt`, and `server.key`.
 Finally, add the following parameters into API server start parameters:

 - `--client-ca-file=/srv/kubernetes/ca.crt`
- `--tls-cert-file=/srv/kubernetes/server.cert`
+- `--tls-cert-file=/srv/kubernetes/server.crt`
 - `--tls-private-key-file=/srv/kubernetes/server.key`

 #### easyrsa
@@ -401,12 +554,12 @@ Finally, add the following parameters into API server start parameters:
 1.  Generate server certificate and key.
    (build-server-full [filename]: Generate a keypair and sign locally for a client or server)

-          ./easyrsa --subject-alt-name="IP:${MASTER_IP}" build-server-full kubernetes-master nopass
-1.  Copy `pki/ca.crt`, `pki/issued/kubernetes-master.crt`, and `pki/private/kubernetes-master.key` to your directory.
+          ./easyrsa --subject-alt-name="IP:${MASTER_IP}" build-server-full server nopass
+1.  Copy `pki/ca.crt`, `pki/issued/server.crt`, and `pki/private/server.key` to your directory.
 1.  Fill in and add the following parameters into the API server start parameters:

          --client-ca-file=/yourdirectory/ca.crt
-          --tls-cert-file=/yourdirectory/server.cert
+          --tls-cert-file=/yourdirectory/server.crt
          --tls-private-key-file=/yourdirectory/server.key

 #### openssl
@@ -2,7 +2,9 @@
 assignees:
 - erictune
 - lavalamp
-
+- deads2k
+- liggitt
+title: Using Authorization Plugins
 ---

 In Kubernetes, authorization happens as a separate step from authentication.
@@ -22,10 +24,9 @@ The following implementations are available, and are selected by flag:
 need authorization.
  - `--authorization-mode=ABAC` allows for a simple local-file-based user-configured
 authorization policy.  ABAC stands for Attribute-Based Access Control.
-authorization policy.
  - `--authorization-mode=RBAC` is an experimental implementation which allows
 for authorization to be driven by the Kubernetes API.
-RBAC stands for Roles-Based Access Control.
+RBAC stands for Role-Based Access Control.
  - `--authorization-mode=Webhook` allows for authorization to be driven by a
 remote service using REST.

@@ -53,7 +54,7 @@ A request has the following attributes that can be considered for authorization:
  - what resource is being accessed (for resource requests only)
  - what subresource is being accessed (for resource requests only)
  - the namespace of the object being accessed (for namespaced resource requests only)
-  - the API group being accessed (for resource requests only)
+  - the API group being accessed (for resource requests only); an empty string designates the [core API group](/docs/api/)

 The request verb for a resource API endpoint can be determined by the HTTP verb used and whether or not the request acts on an individual resource or a collection of resources:

@@ -83,17 +84,27 @@ properties:
    - `kind`, type string: valid values are "Policy". Allows versioning and conversion of the policy format.
  - `spec` property set to a map with the following properties:
    - Subject-matching properties:
-      - `user`, type string; the user-string from `--token-auth-file`. If you specify `user`, it must match the username of the authenticated user. `*` matches all requests.
-      - `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `*` matches all requests.
-    - `readonly`, type boolean, when true, means that the policy only applies to get, list, and watch operations.
+      - `user`, type string; the user-string from `--token-auth-file`. If you specify `user`, it must match the username of the authenticated user.
+      - `group`, type string; if you specify `group`, it must match one of the groups of the authenticated user. `system:authenticated` matches all authenticated requests. `system:unauthenticated` matches all unauthenticated requests.
    - Resource-matching properties:
-      - `apiGroup`, type string; an API group, such as `extensions`. `*` matches all API groups.
-      - `namespace`, type string; a namespace string. `*` matches all resource requests.
-      - `resource`, type string; a resource, such as `pods`. `*` matches all resource requests.
+      - `apiGroup`, type string; an API group.
+        - Ex: `extensions`
+        - Wildcard: `*` matches all API groups.
+      - `namespace`, type string; a namespace.
+        - Ex: `kube-system`
+        - Wildcard: `*` matches all resource requests.
+      - `resource`, type string; a resource type
+        - Ex: `pods`
+        - Wildcard: `*` matches all resource requests.
    - Non-resource-matching properties:
-    - `nonResourcePath`, type string; matches the non-resource request paths (like `/version` and `/apis`). `*` matches all non-resource requests. `/foo/*` matches `/foo/` and all of its subpaths.
+      - `nonResourcePath`, type string; non-resource request paths.
+        - Ex: `/version` or `/apis`
+        - Wildcard: 
+          - `*` matches all non-resource requests.
+          - `/foo/*` matches `/foo/` and all of its subpaths.
+    - `readonly`, type boolean, when true, means that the policy only applies to get, list, and watch operations.

-An unset property is the same as a property set to the zero value for its type
+**NOTES:** An unset property is the same as a property set to the zero value for its type
 (e.g. empty string, 0, false). However, unset should be preferred for
 readability.

@@ -113,8 +124,11 @@ The tuple of attributes is checked for a match against every policy in the
 policy file. If at least one line matches the request attributes, then the
 request is authorized (but may fail later validation).

-To permit any user to do something, write a policy with the user property set to
-`"*"`.
+To permit any authenticated user to do something, write a policy with the
+group property set to `"system:authenticated"`.
+
+To permit any unauthenticated user to do something, write a policy with the
+group property set to `"system:unauthenticated"`.

 To permit a user to do anything, write a policy with the apiGroup, namespace,
 resource, and nonResourcePath properties set to `"*"`.
@@ -163,7 +177,8 @@ up the verbosity:
 5. Anyone can make read-only requests to all non-resource paths:

    ```json
-    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user": "*", "readonly": true, "nonResourcePath": "*"}}
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:authenticated", "readonly": true, "nonResourcePath": "*"}}
+    {"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group": "system:unauthenticated", "readonly": true, "nonResourcePath": "*"}}
    ```

 [Complete file example](http://releases.k8s.io/{{page.githubbranch}}/pkg/auth/authorizer/abac/example_policy_file.jsonl)
@@ -207,6 +222,29 @@ and [enable the API version](
 /docs/admin/cluster-management/#turn-on-or-off-an-api-version-for-your-cluster),
 with a `--runtime-config=` that includes `rbac.authorization.k8s.io/v1alpha1`.

+### Privilege Escalation Prevention and Bootstrapping
+
+The `rbac.authorization.k8s.io` API group inherently attempts to prevent users
+from escalating privileges. Simply put, __a user can't grant permissions they
+don't already have even when the RBAC authorizer it disabled__. If "user-1"
+does not have the ability to read secrets in "namespace-a", they cannot create
+a binding that would grant that permission to themselves or any other user.
+
+When bootstrapping, superuser credentials should include the `system:masters`
+group, for example by creating a client cert with `/O=system:masters`. This
+gives those credentials full access to the API and allows an admin to then set
+up bindings for other users.
+
+In Kubernetes versions 1.4 and 1.5, there was a similar flag that gave a user
+full access:
+
+```
+--authorization-rbac-super-user=admin
+```
+
+__This flag will be removed in 1.6__. Admins should prefer the `system:masters`
+group when setting up clusters.
+
 ### Roles, RolesBindings, ClusterRoles, and ClusterRoleBindings

 The RBAC API Group declares four top level types which will be covered in this
@@ -231,10 +269,9 @@ metadata:
  namespace: default
  name: pod-reader
 rules:
-  - apiGroups: [""] # The API group "" indicates the default API Group.
+  - apiGroups: [""] # The API group "" indicates the core API Group.
    resources: ["pods"]
    verbs: ["get", "watch", "list"]
-    nonResourceURLs: []
 ```

 `ClusterRoles` hold the same information as a `Role` but can apply to any
@@ -274,9 +311,8 @@ subjects:
    name: jane
 roleRef:
  kind: Role
-  namespace: default
  name: pod-reader
-  apiVersion: rbac.authorization.k8s.io/v1alpha1
+  apiGroup: rbac.authorization.k8s.io
 ```

 `RoleBindings` may also refer to a `ClusterRole`. However, a `RoleBinding` that
@@ -301,50 +337,147 @@ subjects:
 roleRef:
  kind: ClusterRole
  name: secret-reader
-  apiVersion: rbac.authorization.k8s.io/v1alpha1
+  apiGroup: rbac.authorization.k8s.io
 ```

 Finally a `ClusterRoleBinding` may be used to grant permissions in all
 namespaces. The following `ClusterRoleBinding` allows any user in the group
-"manager" to read secrets in any namepsace.
+"manager" to read secrets in any namespace.

 ```yaml
 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace.
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1alpha1
 metadata:
-  name: read-secrets
+  name: read-secrets-global
 subjects:
  - kind: Group # May be "User", "Group" or "ServiceAccount"
    name: manager
 roleRef:
  kind: ClusterRole
-  name: secret-reader
-  apiVersion: rbac.authorization.k8s.io/v1alpha1
+  name: secret-reader
+  apiGroup: rbac.authorization.k8s.io
 ```

-### Privilege Escalation Prevention and Bootstrapping
+### Referring to Resources

-The `rbac.authorization.k8s.io` API group inherently attempts to prevent users
-from escalating privileges. Simply put, __a user can't grant permissions they
-don't already have even when the RBAC authorizer it disabled__. If "user-1"
-does not have the ability to read secrets in "namespace-a", they cannot create
-a binding that would grant that permission to themselves or any other user.
-
-For bootstrapping the first roles, it becomes necessary for someone to get
-around these limitations. For the alpha release of RBAC, an API Server flag was
-added to allow one user to step around all RBAC authorization and privilege
-escalation checks. NOTE: _This is subject to change with future releases._
+Most resources are represented by a string representation of their name, such as "pods", just as it
+appears in the URL for the relevant API endpoint. However, some Kubernetes APIs involve a
+"subresource" such as the logs for a pod. The URL for the pods logs endpoint is:

 ```
--authorization-rbac-super-user=admin
+GET /api/v1/namespaces/{namespace}/pods/{name}/log
 ```

-Once set the specified super user, in this case "admin", can be used to create
-the roles and role bindings to initialize the system.
+In this case, "pods" is the namespaced resource, and "log" is a subresource of pods. To represent
+this in an RBAC role, use a slash to delimit the resource and subresource names. To allow a subject
+to read both pods and pod logs, you would write:

-This flag is optional and once the initial bootstrapping is performed can be
-unset.
+```yaml
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1alpha1
+metadata:
+  namespace: default
+  name: pod-and-pod-logs-reader
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "pods/log"]
+    verbs: ["get", "list"]
+```
+
+### Referring to Subjects
+
+RoleBindings and ClusterRoleBindings bind "subjects" to "roles".
+Subjects can be groups, users or service accounts.
+
+Users are represented by strings.  These can be plain usernames, like
+"alice", or email style names, like "bob@example.com", or numeric ids
+as string.  It is up to the Kubernetes admin to configure
+the [authentication modules](/docs/admin/authentication/) to produce
+usernames in the desired format.  The RBAC authorization system does
+not require any particular format.  However, the prefix `system:` is
+reserved for Kubernetes system use, and so the admin should ensure
+usernames should not contain this prefix by accident.
+
+Groups information in Kubernetes is currently provided by the Authenticator
+modules.  (In the future we may add a separate way for the RBAC Authorizer
+to query groups information for users.)  Groups, like users, are represented
+by a string, and that string has no format requirements, other than that the
+prefix `system:` is reserved.
+
+Service Accounts have usernames with the `system:` prefix and belong
+to groups with the `system:` prefix.
+
+#### Role Binding Examples
+
+Only the `subjects` section of a RoleBinding object shown in the following examples.
+
+For a user called `alice@example.com`, specify
+
+```yaml
+subjects:
+  - kind: User
+    name: "alice@example.com"
+```
+
+For a group called `frontend-admins`, specify:
+
+```yaml
+subjects:
+  - kind: Group
+    name: "frontend-admins"
+```
+
+For the default service account in the kube-system namespace:
+
+```yaml
+subjects:
+ - kind: ServiceAccount
+   name: default
+   namespace: kube-system
+```
+
+For all service accounts in the `qa` namespace:
+
+```yaml
+subjects:
+- kind: Group
+  name: system:serviceaccounts:qa
+```
+
+For all service accounts everywhere:
+
+```yaml
+subjects:
+- kind: Group
+  name: system:serviceaccounts
+```
+
+For all authenticated users:
+
+```yaml
+subjects:
+- kind: Group
+  name: system:authenticated
+```
+
+For all unauthenticated users:
+
+```yaml
+subjects:
+- kind: Group
+  name: system:unauthenticated
+```
+
+For all users:
+
+```yaml
+subjects:
+- kind: Group
+  name: system:authenticated
+- kind: Group
+  name: system:unauthenticated
+```

 ## Webhook Mode

@@ -356,7 +489,7 @@ service when determining user privileges.
 Mode `Webhook` requires a file for HTTP configuration, specify by the
 `--authorization-webhook-config-file=SOME_FILENAME` flag.

-The configuration file uses the [kubeconfig](/docs/user-guide/kubeconfig-file/)
+The configuration file uses the [kubeconfig](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/)
 file format. Within the file "users" refers to the API Server webhook and
 "clusters" refers to the remote service.

@@ -382,7 +515,7 @@ current-context: webhook
 contexts:
 - context:
    cluster: name-of-remote-authz-service
-    user: name-of-api-sever
+    user: name-of-api-server
  name: webhook
 ```

@@ -395,7 +528,7 @@ request, and either details about the resource being accessed or requests
 attributes.

 Note that webhook API objects are subject to the same [versioning compatibility rules](/docs/api/)
-as other Kubernetes API objects. Implementers should be aware of loser
+as other Kubernetes API objects. Implementers should be aware of looser
 compatibility promises for beta objects and check the "apiVersion" field of the
 request to ensure correct deserialization. Additionally, the API Server must
 enable the `authorization.k8s.io/v1beta1` API extensions group (`--runtime-config=authorization.k8s.io/v1beta1=true`).
@@ -410,7 +543,7 @@ An example request body:
    "resourceAttributes": {
      "namespace": "kittensandponies",
      "verb": "GET",
-      "group": "*",
+      "group": "unicorn.example.org",
      "resource": "pods"
    },
    "user": "jane",
@@ -471,10 +604,10 @@ Access to non-resource paths are sent as:

 Non-resource paths include: `/api`, `/apis`, `/metrics`, `/resetMetrics`,
 `/logs`, `/debug`, `/healthz`, `/swagger-ui/`, `/swaggerapi/`, `/ui`, and
-`/version.` Clients require access to `/api`, `/api/*/`, `/apis/`, `/apis/*`,
-`/apis/*/*`, and `/version` to discover what resources and versions are present
-on the server. Access to other non-resource paths can be disallowed without
-restricting access to the REST api.
+`/version.` Clients require access to `/api`, `/api/*`, `/apis`, `/apis/*`,
+and `/version` to discover what resources and versions are present on the server.
+Access to other non-resource paths can be disallowed without restricting access
+to the REST api.

 For further documentation refer to the authorization.v1beta1 API objects and
 plugin/pkg/auth/authorizer/webhook/webhook.go.
@@ -533,9 +666,9 @@ __EOF__

 --- snip lots of output ---

-I0913 08:12:31.362873   27425 request.go:908] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"resourceAttributes":{"namespace":"kittensandponies","verb":"GET","group":"*","resource":"pods"},"user":"jane","group":["group1","group2"]},"status":{"allowed":true}}
+I0913 08:12:31.362873   27425 request.go:908] Response Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"resourceAttributes":{"namespace":"kittensandponies","verb":"GET","group":"unicorn.example.org","resource":"pods"},"user":"jane","group":["group1","group2"]},"status":{"allowed":true}}
 subjectaccessreview "" created
 ```

 This is useful for debugging access problems, in that you can use this resource
-to determine what access an authorizer is granting.
+to determine what access an authorizer is granting.
@@ -1,143 +1,9 @@
 ---
 assignees:
 - lavalamp
-
+title: Kubernetes Components
 ---

-This document outlines the various binary components that need to run to
-deliver a functioning Kubernetes cluster.
+{% include user-guide-content-moved.md %}

-## Master Components
-
-Master components are those that provide the cluster's control plane. For
-example, master components are responsible for making global decisions about the
-cluster (e.g., scheduling), and detecting and responding to cluster events
-(e.g., starting up a new pod when a replication controller's 'replicas' field is
-unsatisfied).
-
-Master components could in theory be run on any node in the cluster. However,
-for simplicity, current set up scripts typically start all master components on
-the same VM, and does not run user containers on this VM. See
-[high-availability.md](/docs/admin/high-availability) for an example multi-master-VM setup.
-
-Even in the future, when Kubernetes is fully self-hosting, it will probably be
-wise to only allow master components to schedule on a subset of nodes, to limit
-co-running with user-run pods, reducing the possible scope of a
-node-compromising security exploit.
-
-### kube-apiserver
-
-[kube-apiserver](/docs/admin/kube-apiserver) exposes the Kubernetes API; it is the front-end for the
-Kubernetes control plane. It is designed to scale horizontally (i.e., one scales
-it by running more of them-- [high-availability.md](/docs/admin/high-availability)).
-
-### etcd
-
-[etcd](/docs/admin/etcd) is used as Kubernetes' backing store. All cluster data is stored here.
-Proper administration of a Kubernetes cluster includes a backup plan for etcd's
-data.
-
-### kube-controller-manager
-
-[kube-controller-manager](/docs/admin/kube-controller-manager) is a binary that runs controllers, which are the
-background threads that handle routine tasks in the cluster. Logically, each
-controller is a separate process, but to reduce the number of moving pieces in
-the system, they are all compiled into a single binary and run in a single
-process.
-
-These controllers include:
-
-* Node Controller: Responsible for noticing & responding when nodes go down.
-* Replication Controller: Responsible for maintaining the correct number of pods for every replication
-  controller object in the system.
-* Endpoints Controller: Populates the Endpoints object (i.e., join Services & Pods).
-* Service Account & Token Controllers: Create default accounts and API access tokens for new namespaces.
-* ... and others.
-
-### kube-scheduler
-
-[kube-scheduler](/docs/admin/kube-scheduler) watches newly created pods that have no node assigned, and
-selects a node for them to run on.
-
-### addons
-
-Addons are pods and services that implement cluster features. They don't run on
-the master VM, but currently the default setup scripts that make the API calls
-to create these pods and services does run on the master VM. See:
-[kube-master-addons](http://releases.k8s.io/HEAD/cluster/saltbase/salt/kube-master-addons/kube-master-addons.sh)
-
-Addon objects are created in the "kube-system" namespace.
-
-#### DNS
-
-While the other addons are not strictly required, all Kubernetes
-clusters should have [cluster DNS](/docs/admin/dns/), as many examples rely on it.
-
-Cluster DNS is a DNS server, in addition to the other DNS server(s) in your
-environment, which serves DNS records for Kubernetes services.
-
-Containers started by Kubernetes automatically include this DNS server
-in their DNS searches.
-
-#### User interface
-
-The kube-ui provides a read-only overview of the cluster state.  Access
-[the UI using kubectl proxy](/docs/user-guide/connecting-to-applications-proxy/#connecting-to-the-kube-ui-service-from-your-local-workstation)
-
-#### Container Resource Monitoring
-
-[Container Resource Monitoring](/docs/user-guide/monitoring) records generic time-series metrics
-about containers in a central database, and provides a UI for browsing that data.
-
-#### Cluster-level Logging
-
-[Container Logging](/docs/user-guide/monitoring) saves container logs
-to a central log store with search/browsing interface.  There are two
-implementations:
-
-* [Cluster-level logging to Google Cloud Logging](
-/docs/user-guide/logging/#cluster-level-logging-to-google-cloud-logging)
-
-* [Cluster-level Logging with Elasticsearch and Kibana](
-/docs/getting-started-guides/logging-elasticsearch/)
-
-## Node components
-
-Node components run on every node, maintaining running pods and providing them
-the Kubernetes runtime environment.
-
-### kubelet
-
-[kubelet](/docs/admin/kubelet) is the primary node agent. It:
-
-* Watches for pods that have been assigned to its node (either by apiserver
-  or via local configuration file) and:
-* Mounts the pod's required volumes
-* Downloads the pod's secrets
-* Run the pod's containers via docker (or, experimentally, rkt).
-* Periodically executes any requested container liveness probes.
-* Reports the status of the pod back to the rest of the system, by creating a
-  "mirror pod" if necessary.
-* Reports the status of the node back to the rest of the system.
-
-### kube-proxy
-
-[kube-proxy](/docs/admin/kube-proxy) enables the Kubernetes service abstraction by maintaining
-network rules on the host and performing connection forwarding.
-
-### docker
-
-`docker` is of course used for actually running containers.
-
-### rkt
-
-`rkt` is supported experimentally as an alternative to docker.
-
-### supervisord
-
-`supervisord` is a lightweight process babysitting system for keeping kubelet and docker
-running.
-
-### fluentd
-
-`fluentd` is a daemon which helps provide [cluster-level logging](#cluster-level-logging).
+[Kubernetes Components](/docs/concepts/overview/components/)
@@ -1,126 +1,127 @@
---
-assignees:
- davidopp
- lavalamp
-
---
-
-
-## Support
-
-At {{page.version}}, Kubernetes supports clusters with up to 1000 nodes. More specifically, we support configurations that meet *all* of the following criteria:
-
-* No more than 2000 nodes
-* No more than 60000 total pods
-* No more than 120000 total containers
-* No more than 100 pods per node
-
-* TOC
-{:toc}
-
-## Setup
-
-A cluster is a set of nodes (physical or virtual machines) running Kubernetes agents, managed by a "master" (the cluster-level control plane).
-
-Normally the number of nodes in a cluster is controlled by the the value `NUM_NODES` in the platform-specific `config-default.sh` file (for example, see [GCE's `config-default.sh`](http://releases.k8s.io/{{page.githubbranch}}/cluster/gce/config-default.sh)).
-
-Simply changing that value to something very large, however, may cause the setup script to fail for many cloud providers. A GCE deployment, for example, will run in to quota issues and fail to bring the cluster up.
-
-When setting up a large Kubernetes cluster, the following issues must be considered.
-
-### Quota Issues
-
-To avoid running into cloud provider quota issues, when creating a cluster with many nodes, consider:
-
-* Increase the quota for things like CPU, IPs, etc.
-  * In [GCE, for example,](https://cloud.google.com/compute/docs/resource-quotas) you'll want to increase the quota for:
-    * CPUs
-    * VM instances
-    * Total persistent disk reserved
-    * In-use IP addresses
-    * Firewall Rules
-    * Forwarding rules
-    * Routes
-    * Target pools
-* Gating the setup script so that it brings up new node VMs in smaller batches with waits in between, because some cloud providers rate limit the creation of VMs.
-
-### Etcd storage
-
-To improve performance of large clusters, we store events in a separate dedicated etcd instance.
-
-When creating a cluster, existing salt scripts:
-
-* start and configure additional etcd instance
-* configure api-server to use it for storing events
-
-### Size of master and master components
-
-On GCE/GKE and AWS, `kube-up` automatically configures the proper VM size for your master depending on the number of nodes
-in your cluster. On other providers, you will need to configure it manually. For reference, the sizes we use on GCE are
-
-* 1-5 nodes: n1-standard-1
-* 6-10 nodes: n1-standard-2
-* 11-100 nodes: n1-standard-4
-* 101-250 nodes: n1-standard-8
-* 251-500 nodes: n1-standard-16
-* more than 500 nodes: n1-standard-32
-
-And the sizes we use on AWS are
-
-* 1-5 nodes: m3.medium
-* 6-10 nodes: m3.large
-* 11-100 nodes: m3.xlarge
-* 101-250 nodes: m3.2xlarge
-* 251-500 nodes: c4.4xlarge
-* more than 500 nodes: c4.8xlarge
-
-Note that these master node sizes are currently only set at cluster startup time, and are not adjusted if you later scale your cluster up or down (e.g. manually removing or adding nodes, or using a cluster autoscaler).
-
-### Addon Resources
-
-To prevent memory leaks or other resource issues in [cluster addons](https://releases.k8s.io/{{page.githubbranch}}/cluster/addons) from consuming all the resources available on a node, Kubernetes sets resource limits on addon containers to limit the CPU and Memory resources they can consume (See PR [#10653](http://pr.k8s.io/10653/files) and [#10778](http://pr.k8s.io/10778/files)).
-
-For [example](https://github.com/kubernetes/kubernetes/tree/{{page.githubbranch}}/cluster/saltbase/salt/fluentd-gcp/fluentd-gcp.yaml):
-
-```yaml
-  containers:
-  - name: fluentd-cloud-logging
-    image: gcr.io/google_containers/fluentd-gcp:1.16
-    resources:
-      limits:
-        cpu: 100m
-        memory: 200Mi
-```
-
-Except for Heapster, these limits are static and are based on data we collected from addons running on 4-node clusters (see [#10335](http://issue.k8s.io/10335#issuecomment-117861225)). The addons consume a lot more resources when running on large deployment clusters (see [#5880](http://issue.k8s.io/5880#issuecomment-113984085)). So, if a large cluster is deployed without adjusting these values, the addons may continuously get killed because they keep hitting the limits.
-
-To avoid running into cluster addon resource issues, when creating a cluster with many nodes, consider the following:
-
-* Scale memory and CPU limits for each of the following addons, if used, as you scale up the size of cluster (there is one replica of each handling the entire cluster so memory and CPU usage tends to grow proportionally with size/load on cluster):
-  * [InfluxDB and Grafana](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml)
-  * [skydns, kube2sky, and dns etcd](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/dns/skydns-rc.yaml.in)
-  * [Kibana](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/fluentd-elasticsearch/kibana-controller.yaml)
-* Scale number of replicas for the following addons, if used, along with the size of cluster (there are multiple replicas of each so increasing replicas should help handle increased load, but, since load per replica also increases slightly, also consider increasing CPU/memory limits):
-  * [elasticsearch](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/fluentd-elasticsearch/es-controller.yaml)
-* Increase memory and CPU limits slightly for each of the following addons, if used, along with the size of cluster (there is one replica per node but CPU/memory usage increases slightly along with cluster load/size as well):
-  * [FluentD with ElasticSearch Plugin](http://releases.k8s.io/{{page.githubbranch}}/cluster/saltbase/salt/fluentd-es/fluentd-es.yaml)
-  * [FluentD with GCP Plugin](http://releases.k8s.io/{{page.githubbranch}}/cluster/saltbase/salt/fluentd-gcp/fluentd-gcp.yaml)
-
-Heapster's resource limits are set dynamically based on the initial size of your cluster (see [#16185](http://issue.k8s.io/16185)
-and [#22940](http://issue.k8s.io/22940)). If you find that Heapster is running
-out of resources, you should adjust the formulas that compute heapster memory request (see those PRs for details).
-
-For directions on how to detect if addon containers are hitting resource limits, see the [Troubleshooting section of Compute Resources](/docs/user-guide/compute-resources/#troubleshooting).
-
-In the [future](http://issue.k8s.io/13048), we anticipate to set all cluster addon resource limits based on cluster size, and to dynamically adjust them if you grow or shrink your cluster.
-We welcome PRs that implement those features.
-
-### Allowing minor node failure at startup
-
-For various reasons (see [#18969](https://github.com/kubernetes/kubernetes/issues/18969) for more details) running
-`kube-up.sh` with a very large `NUM_NODES` may fail due to a very small number of nodes not coming up properly.
-Currently you have two choices: restart the cluster (`kube-down.sh` and then `kube-up.sh` again), or before
-running `kube-up.sh` set the environment variable `ALLOWED_NOTREADY_NODES` to whatever value you feel comfortable
-with. This will allow `kube-up.sh` to succeed with fewer than `NUM_NODES` coming up. Depending on the
-reason for the failure, those additional nodes may join later or the cluster may remain at a size of
-`NUM_NODES - ALLOWED_NOTREADY_NODES`.
+---
+assignees:
+- davidopp
+- lavalamp
+title: Building Large Clusters
+---
+
+## Support
+
+At {{page.version}}, Kubernetes supports clusters with up to 1000 nodes. More specifically, we support configurations that meet *all* of the following criteria:
+
+* No more than 2000 nodes
+* No more than 60000 total pods
+* No more than 120000 total containers
+* No more than 100 pods per node
+
+<br>
+
+* TOC
+{:toc}
+
+## Setup
+
+A cluster is a set of nodes (physical or virtual machines) running Kubernetes agents, managed by a "master" (the cluster-level control plane).
+
+Normally the number of nodes in a cluster is controlled by the the value `NUM_NODES` in the platform-specific `config-default.sh` file (for example, see [GCE's `config-default.sh`](http://releases.k8s.io/{{page.githubbranch}}/cluster/gce/config-default.sh)).
+
+Simply changing that value to something very large, however, may cause the setup script to fail for many cloud providers. A GCE deployment, for example, will run in to quota issues and fail to bring the cluster up.
+
+When setting up a large Kubernetes cluster, the following issues must be considered.
+
+### Quota Issues
+
+To avoid running into cloud provider quota issues, when creating a cluster with many nodes, consider:
+
+* Increase the quota for things like CPU, IPs, etc.
+  * In [GCE, for example,](https://cloud.google.com/compute/docs/resource-quotas) you'll want to increase the quota for:
+    * CPUs
+    * VM instances
+    * Total persistent disk reserved
+    * In-use IP addresses
+    * Firewall Rules
+    * Forwarding rules
+    * Routes
+    * Target pools
+* Gating the setup script so that it brings up new node VMs in smaller batches with waits in between, because some cloud providers rate limit the creation of VMs.
+
+### Etcd storage
+
+To improve performance of large clusters, we store events in a separate dedicated etcd instance.
+
+When creating a cluster, existing salt scripts:
+
+* start and configure additional etcd instance
+* configure api-server to use it for storing events
+
+### Size of master and master components
+
+On GCE/GKE and AWS, `kube-up` automatically configures the proper VM size for your master depending on the number of nodes
+in your cluster. On other providers, you will need to configure it manually. For reference, the sizes we use on GCE are
+
+* 1-5 nodes: n1-standard-1
+* 6-10 nodes: n1-standard-2
+* 11-100 nodes: n1-standard-4
+* 101-250 nodes: n1-standard-8
+* 251-500 nodes: n1-standard-16
+* more than 500 nodes: n1-standard-32
+
+And the sizes we use on AWS are
+
+* 1-5 nodes: m3.medium
+* 6-10 nodes: m3.large
+* 11-100 nodes: m3.xlarge
+* 101-250 nodes: m3.2xlarge
+* 251-500 nodes: c4.4xlarge
+* more than 500 nodes: c4.8xlarge
+
+Note that these master node sizes are currently only set at cluster startup time, and are not adjusted if you later scale your cluster up or down (e.g. manually removing or adding nodes, or using a cluster autoscaler).
+
+### Addon Resources
+
+To prevent memory leaks or other resource issues in [cluster addons](https://releases.k8s.io/{{page.githubbranch}}/cluster/addons) from consuming all the resources available on a node, Kubernetes sets resource limits on addon containers to limit the CPU and Memory resources they can consume (See PR [#10653](http://pr.k8s.io/10653/files) and [#10778](http://pr.k8s.io/10778/files)).
+
+For [example](https://github.com/kubernetes/kubernetes/tree/{{page.githubbranch}}/cluster/saltbase/salt/fluentd-gcp/fluentd-gcp.yaml):
+
+```yaml
+  containers:
+  - name: fluentd-cloud-logging
+    image: gcr.io/google_containers/fluentd-gcp:1.16
+    resources:
+      limits:
+        cpu: 100m
+        memory: 200Mi
+```
+
+Except for Heapster, these limits are static and are based on data we collected from addons running on 4-node clusters (see [#10335](http://issue.k8s.io/10335#issuecomment-117861225)). The addons consume a lot more resources when running on large deployment clusters (see [#5880](http://issue.k8s.io/5880#issuecomment-113984085)). So, if a large cluster is deployed without adjusting these values, the addons may continuously get killed because they keep hitting the limits.
+
+To avoid running into cluster addon resource issues, when creating a cluster with many nodes, consider the following:
+
+* Scale memory and CPU limits for each of the following addons, if used, as you scale up the size of cluster (there is one replica of each handling the entire cluster so memory and CPU usage tends to grow proportionally with size/load on cluster):
+  * [InfluxDB and Grafana](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml)
+  * [kubedns, dnsmasq, and sidecar](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/dns/kubedns-controller.yaml.in)
+  * [Kibana](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/fluentd-elasticsearch/kibana-controller.yaml)
+* Scale number of replicas for the following addons, if used, along with the size of cluster (there are multiple replicas of each so increasing replicas should help handle increased load, but, since load per replica also increases slightly, also consider increasing CPU/memory limits):
+  * [elasticsearch](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/fluentd-elasticsearch/es-controller.yaml)
+* Increase memory and CPU limits slightly for each of the following addons, if used, along with the size of cluster (there is one replica per node but CPU/memory usage increases slightly along with cluster load/size as well):
+  * [FluentD with ElasticSearch Plugin](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/fluentd-elasticsearch/fluentd-es-ds.yaml)
+  * [FluentD with GCP Plugin](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/fluentd-gcp/fluentd-gcp-ds.yaml)
+
+Heapster's resource limits are set dynamically based on the initial size of your cluster (see [#16185](http://issue.k8s.io/16185)
+and [#22940](http://issue.k8s.io/22940)). If you find that Heapster is running
+out of resources, you should adjust the formulas that compute heapster memory request (see those PRs for details).
+
+For directions on how to detect if addon containers are hitting resource limits, see the [Troubleshooting section of Compute Resources](/docs/user-guide/compute-resources/#troubleshooting).
+
+In the [future](http://issue.k8s.io/13048), we anticipate to set all cluster addon resource limits based on cluster size, and to dynamically adjust them if you grow or shrink your cluster.
+We welcome PRs that implement those features.
+
+### Allowing minor node failure at startup
+
+For various reasons (see [#18969](https://github.com/kubernetes/kubernetes/issues/18969) for more details) running
+`kube-up.sh` with a very large `NUM_NODES` may fail due to a very small number of nodes not coming up properly.
+Currently you have two choices: restart the cluster (`kube-down.sh` and then `kube-up.sh` again), or before
+running `kube-up.sh` set the environment variable `ALLOWED_NOTREADY_NODES` to whatever value you feel comfortable
+with. This will allow `kube-up.sh` to succeed with fewer than `NUM_NODES` coming up. Depending on the
+reason for the failure, those additional nodes may join later or the cluster may remain at a size of
+`NUM_NODES - ALLOWED_NOTREADY_NODES`.
@@ -2,7 +2,7 @@
 assignees:
 - lavalamp
 - thockin
-
+title: Cluster Management Guide
 ---

 * TOC
@@ -19,7 +19,9 @@ To install Kubernetes on a set of machines, consult one of the existing [Getting

 ## Upgrading a cluster

-The current state of cluster upgrades is provider dependent.
+The current state of cluster upgrades is provider dependent, and some releases may require special care when upgrading. It is recommended that administrators consult both the [release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG.md), as well as the version specific upgrade notes prior to upgrading their clusters.
+
+* [Upgrading to 1.6](/docs/admin/upgrade-1-6)

 ### Upgrading Google Compute Engine clusters

@@ -56,8 +58,12 @@ The node upgrade process is user-initiated and is described in the [GKE document

 ### Upgrading clusters on other platforms

-The `cluster/kube-push.sh` script will do a rudimentary update.  This process is still quite experimental, we
-recommend testing the upgrade on an experimental cluster before performing the update on a production cluster.
+Different providers, and tools, will manage upgrades differently.  It is recommended that you consult their main documentation regarding upgrades.
+
+* [kops](https://github.com/kubernetes/kops)
+* [kargo](https://github.com/kubernetes-incubator/kargo)
+* [CoreOS Tectonic](https://coreos.com/tectonic/docs/latest/admin/upgrade.html)
+* ...

 ## Resizing a cluster

@@ -72,7 +78,6 @@ Instance Group will take care of putting appropriate image on new machines and s

 In other environments you may need to configure the machine yourself and tell the Kubelet on which machine API server is running.

-
 ### Cluster autoscaling

 If you are using GCE or GKE, you can configure your cluster so that it is automatically rescaled based on
@@ -84,24 +89,24 @@ no node that has enough free capacity (or doesn't match other pod requirements)
 to wait until some pods are terminated or a new node is added.

 Cluster autoscaler looks for the pods that cannot be scheduled and checks if adding a new node, similar
-to the other in the cluster, would help. If yes, then it resizes the cluster to accomodate the waiting pods.
+to the other in the cluster, would help. If yes, then it resizes the cluster to accommodate the waiting pods.

 Cluster autoscaler also scales down the cluster if it notices that some node is not needed anymore for
 an extended period of time (10min but it may change in the future).

 Cluster autoscaler is configured per instance group (GCE) or node pool (GKE).

-If you are using GCE then you can either enable it while creating a cluster with kube-up.sh script. 
-To configure cluser autoscaler you have to set 3 environment variables:
+If you are using GCE then you can either enable it while creating a cluster with kube-up.sh script.
+To configure cluster autoscaler you have to set three environment variables:

 * `KUBE_ENABLE_CLUSTER_AUTOSCALER` - it enables cluster autoscaler if set to true.
-* `KUBE_AUTOSCALING_MIN_NODES` - minimum number of nodes in the cluster.
-* `KUBE_AUTOSCALING_MAX_NODES` - maximum number of nodes in the cluster.
+* `KUBE_AUTOSCALER_MIN_NODES` - minimum number of nodes in the cluster.
+* `KUBE_AUTOSCALER_MAX_NODES` - maximum number of nodes in the cluster.

 Example:

 ```shell
-KUBE_ENABLE_CLUSTER_AUTOSCALER=true KUBE_AUTOSCALING_MIN_NODES=3 KUBE_AUTOSCALING_MAX_NODES=10 NUM_NODES=5 ./cluster/kube-up.sh
+KUBE_ENABLE_CLUSTER_AUTOSCALER=true KUBE_AUTOSCALER_MIN_NODES=3 KUBE_AUTOSCALER_MAX_NODES=10 NUM_NODES=5 ./cluster/kube-up.sh
 ```

 On GKE you configure cluster autoscaler either on cluster creation or update or when creating a particular node pool
@@ -159,11 +164,11 @@ node discovery; currently this is only Google Compute Engine, not including Core

 ### Upgrading to a different API version

-When a new API version is released, you may need to upgrade a cluster to support the new API version (e.g. switching from 'v1' to 'v2' when 'v2' is launched)
+When a new API version is released, you may need to upgrade a cluster to support the new API version (e.g. switching from 'v1' to 'v2' when 'v2' is launched).

 This is an infrequent event, but it requires careful management. There is a sequence of steps to upgrade to a new API version.

-   1. Turn on the new api version.
+   1. Turn on the new API version.
   1. Upgrade the cluster's storage to use the new version.
   1. Upgrade all config files. Identify users of the old API version endpoints.
   1. Update existing objects in the storage to new version by running `cluster/update-storage-objects.sh`.
@@ -171,16 +176,16 @@ This is an infrequent event, but it requires careful management. There is a sequ

 ### Turn on or off an API version for your cluster

-Specific API versions can be turned on or off by passing --runtime-config=api/<version> flag while bringing up the API server. For example: to turn off v1 API, pass `--runtime-config=api/v1=false`.
+Specific API versions can be turned on or off by passing `--runtime-config=api/<version>` flag while bringing up the API server. For example: to turn off v1 API, pass `--runtime-config=api/v1=false`.
 runtime-config also supports 2 special keys: api/all and api/legacy to control all and legacy APIs respectively.
-For example, for turning off all api versions except v1, pass `--runtime-config=api/all=false,api/v1=true`.
+For example, for turning off all API versions except v1, pass `--runtime-config=api/all=false,api/v1=true`.
 For the purposes of these flags, _legacy_ APIs are those APIs which have been explicitly deprecated (e.g. `v1beta3`).

 ### Switching your cluster's storage API version

 The objects that are stored to disk for a cluster's internal representation of the Kubernetes resources active in the cluster are written using a particular version of the API.
 When the supported API changes, these objects may need to be rewritten in the newer API.  Failure to do this will eventually result in resources that are no longer decodable or usable
-by the kubernetes API server.
+by the Kubernetes API server.

 `KUBE_API_VERSIONS` environment variable for the `kube-apiserver` binary which controls the API versions that are supported in the cluster. The first version in the list is used as the cluster's storage version. Hence, to set a specific version as the storage version, bring it to the front of list of versions in the value of `KUBE_API_VERSIONS`.  You need to restart the `kube-apiserver` binary
 for changes to this variable to take effect.
@@ -190,7 +195,7 @@ for changes to this variable to take effect.
 You can use `kubectl convert` command to convert config files between different API versions.

 ```shell
-$ kubectl convert -f pod.yaml --output-version v1
+kubectl convert -f pod.yaml --output-version v1
 ```

 For more options, please refer to the usage of [kubectl convert](/docs/user-guide/kubectl/kubectl_convert/) command.
@@ -1,7 +1,7 @@
 ---
 assignees:
 - davidopp
-
+title: Troubleshooting Clusters
 ---

 This doc is about cluster troubleshooting; we assume you have already ruled out your application as the root cause of the
@@ -89,7 +89,7 @@ Mitigations:
  - Mitigates: Apiserver VM shutdown or apiserver crashing
  - Mitigates: Supporting services VM shutdown or crashes

- Action use IaaS providers reliable storage (e.g GCE PD or AWS EBS volume) for VMs with apiserver+etcd
+- Action: Use IaaS providers reliable storage (e.g. GCE PD or AWS EBS volume) for VMs with apiserver+etcd
  - Mitigates: Apiserver backing storage lost

 - Action: Use (experimental) [high-availability](/docs/admin/high-availability) configuration
@@ -112,4 +112,4 @@ Mitigations:
  - Mitigates: Kubelet software fault

 - Action: [Multiple independent clusters](/docs/admin/multi-cluster) (and avoid making risky changes to all clusters at once)
-  - Mitigates: Everything listed above.
+  - Mitigates: Everything listed above.
@@ -1,28 +1,28 @@
 ---
 assignees:
 - erictune
-
+title: Daemon Sets
 ---

 * TOC
 {:toc}

-## What is a _Daemon Set_?
+## What is a DaemonSet?

-A _Daemon Set_ ensures that all (or some) nodes run a copy of a pod.  As nodes are added to the
+A _DaemonSet_ ensures that all (or some) nodes run a copy of a pod.  As nodes are added to the
 cluster, pods are added to them.  As nodes are removed from the cluster, those pods are garbage
-collected.  Deleting a Daemon Set will clean up the pods it created.
+collected.  Deleting a DaemonSet will clean up the pods it created.

-Some typical uses of a Daemon Set are:
+Some typical uses of a DaemonSet are:

 - running a cluster storage daemon, such as `glusterd`, `ceph`, on each node.
 - running a logs collection daemon on every node, such as `fluentd` or `logstash`.
 - running a node monitoring daemon on every node, such as [Prometheus Node Exporter](
  https://github.com/prometheus/node_exporter), `collectd`, New Relic agent, or Ganglia `gmond`.

-In a simple case, one Daemon Set, covering all nodes, would be used for each type of daemon.
-A more complex setup might use multiple DaemonSets would be used for a single type of daemon,
-but with different flags and/or different memory and cpu requests for different hardware types.
+In a simple case, one DaemonSet, covering all nodes, would be used for each type of daemon.
+A more complex setup might use multiple DaemonSets for a single type of daemon, but with
+different flags and/or different memory and cpu requests for different hardware types.

 ## Writing a DaemonSet Spec

@@ -51,7 +51,7 @@ A pod template in a DaemonSet must have a [`RestartPolicy`](/docs/user-guide/pod
 ### Pod Selector

 The `.spec.selector` field is a pod selector.  It works the same as the `.spec.selector` of
-a [Job](/docs/user-guide/jobs/) or other new resources.
+a [Job](/docs/concepts/jobs/run-to-completion-finite-workloads/) or other new resources.

 The `spec.selector` is an object consisting of two fields:

@@ -74,7 +74,7 @@ a node for testing.

 If you specify a `.spec.template.spec.nodeSelector`, then the DaemonSet controller will
 create pods on nodes which match that [node
-selector](https://github.com/kubernetes/kubernetes.github.io/tree/{{page.docsbranch}}/docs/user-guide/node-selection).  
+selector](/docs/user-guide/node-selection/).
 If you specify a `scheduler.alpha.kubernetes.io/affinity` annotation in `.spec.template.metadata.annotations`,
 then DaemonSet controller will create pods on nodes which match that [node affinity](../../user-guide/node-selection/#alpha-feature-in-kubernetes-v12-node-affinity).

@@ -88,18 +88,17 @@ created by the Daemon controller have the machine already selected (`.spec.nodeN
 when the pod is created, so it is ignored by the scheduler).  Therefore:

 - the [`unschedulable`](/docs/admin/node/#manual-node-administration) field of a node is not respected
-   by the daemon set controller.
- - daemon set controller can make pods even when the scheduler has not been started, which can help cluster
+   by the DaemonSet controller.
+ - DaemonSet controller can make pods even when the scheduler has not been started, which can help cluster
   bootstrap.

 ## Communicating with DaemonSet Pods

 Some possible patterns for communicating with pods in a DaemonSet are:

- **Push**: Pods in the Daemon Set are configured to send updates to another service, such
+- **Push**: Pods in the DaemonSet are configured to send updates to another service, such
  as a stats database.  They do not have clients.
- **NodeIP and Known Port**: Pods in the Daemon Set use a `hostPort`, so that the pods are reachable
-  via the node IPs.  Clients knows the the list of nodes ips somehow, and know the port by convention.
+- **NodeIP and Known Port**: Pods in the DaemonSet use a `hostPort`, so that the pods are reachable via the node IPs.  Clients know the list of nodes ips somehow, and know the port by convention.
 - **DNS**: Create a [headless service](/docs/user-guide/services/#headless-services) with the same pod selector,
  and then discover DaemonSets using the `endpoints` resource or retrieve multiple A records from
  DNS.
@@ -126,11 +125,11 @@ You cannot update a DaemonSet.

 Support for updating DaemonSets and controlled updating of nodes is planned.

-## Alternatives to Daemon Set
+## Alternatives to DaemonSet

 ### Init Scripts

-It is certainly possible to run daemon processes by directly starting them on a node (e.g using
+It is certainly possible to run daemon processes by directly starting them on a node (e.g. using
 `init`, `upstartd`, or `systemd`).  This is perfectly fine.  However, there are several advantages to
 running such processes via a DaemonSet:

@@ -145,9 +144,9 @@ running such processes via a DaemonSet:
 ### Bare Pods

 It is possible to create pods directly which specify a particular node to run on.  However,
-a Daemon Set replaces pods that are deleted or terminated for any reason, such as in the case of
+a DaemonSet replaces pods that are deleted or terminated for any reason, such as in the case of
 node failure or disruptive node maintenance, such as a kernel upgrade. For this reason, you should
-use a Daemon Set rather than creating individual pods.
+use a DaemonSet rather than creating individual pods.

 ### Static Pods

@@ -159,7 +158,7 @@ in cluster bootstrapping cases.  Also, static pods may be deprecated in the futu

 ### Replication Controller

-Daemon Set are similar to [Replication Controllers](/docs/user-guide/replication-controller) in that
+DaemonSet are similar to [Replication Controllers](/docs/user-guide/replication-controller) in that
 they both create pods, and those pods have processes which are not expected to terminate (e.g. web servers,
 storage servers).

@@ -1,95 +1,9 @@
 ---
 assignees:
- mml
-
+- davidopp
+title: Pod Disruption Budget
 ---
-This guide is for anyone wishing to specify safety constraints on pods or anyone
-wishing to write software (typically automation software) that respects those
-constraints.

-* TOC
-{:toc}
+{% include user-guide-content-moved.md %}

-## Rationale
-
-Various cluster management operations may voluntarily evict pods.  "Voluntary"
-means an eviction can be safely delayed for a reasonable period of time. The
-principal examples today are draining a node for maintenance or upgrade
-(`kubectl drain`), and cluster autoscaling down. In the future the
-[rescheduler](https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/rescheduling.md)
-may also perform voluntary evictions.  By contrast, something like evicting pods
-because a node has become unreachable or reports `NotReady`, is not "voluntary."
-
-For voluntary evictions, it can be useful for applications to be able to limit
-the number of pods that are down simultaneously.  For example, a quorum-based application would
-like to ensure that the number of replicas running is never brought below the
-number needed for a quorum, even temporarily. Or a web front end might want to
-ensure that the number of replicas serving load never falls below a certain
-percentage of the total, even briefly.  `PodDisruptionBudget` is an API object
-that specifies the minimum number or percentage of replicas of a collection that
-must be up at a time.  Components that wish to evict a pod subject to disruption
-budget use the `/eviction` subresource; unlike a regular pod deletion, this
-operation may be rejected by the API server if the eviction would cause a
-disruption budget to be violated.
-
-## Specifying a PodDisruptionBudget
-
-A `PodDisruptionBudget` has two components: a label selector `selector` to specify the set of
-pods to which it applies, and `minAvailable` which is a description of the number of pods from that
-set that must still be available after the eviction, i.e. even in the absence
-of the evicted pod. `minAvailable` can be either an absolute number or a percentage.
-So for example, 100% means no voluntary evictions from the set are permitted. In
-typical usage, a single budget would be used for a collection of pods managed by
-a controller—for example, the pods in a single ReplicaSet.
-
-Note that a disruption budget does not truly guarantee that the specified
-number/percentage of pods will always be up.  For example, a node that hosts a
-pod from the collection may fail when the collection is at the minimum size
-specified in the budget, thus bringing the number of available pods from the
-collection below the specified size. The budget can only protect against
-voluntary evictions, not all causes of unavailability.
-
-## Requesting an eviction
-
-If you are writing infrastructure software that wants to produce these voluntary
-evictions, you will need to use the eviction API.  The eviction subresource of a
-pod can be thought of as a kind of policy-controlled DELETE operation on the pod
-itself.  To attempt an eviction (perhaps more REST-precisely, to attempt to
-*create* an eviction), you POST an attempted operation.  Here's an example:
-
-```json
-{
-  "apiVersion": "policy/v1alpha1",
-  "kind": "Eviction",
-  "name": "quux",
-  "namespace": "default"
-}
-```
-
-and here is how you would attempt this with `curl`
-
-```bash
-curl -v -X POST -H 'Content-type: application/json'
-http://127.0.0.1:8080/api/v1/namespaces/default/pods/quux/eviction -d
-eviction.json
-```
-
-The API can respond in one of three ways.
-
- 1. If the eviction is granted, then the pod is deleted just as if you had sent
-    a `DELETE` request to the pod's URL and you get back `200 OK`.
- 2. If the current state of affairs wouldn't allow an eviction by the rules set
-    forth in the budget, you get back `429 Too Many Requests`.  This is
-    typically used for generic rate limiting of *any* requests, but here we mean
-    that this request isn't allowed *right now* but it may be allowed later.
-    Currently, callers do not get any `Retry-After` advice, but they may in
-    future versions.
- 3. If there is some kind of misconfiguration, like multiple budgets pointing at
-    the same pod, you will get `500 Internal Server Error`.
-
-For a given eviction request, there are two cases.
-
- 1. There is no budget that matches this pod.  In this case, the server always
-    returns `200 OK`.
- 2. There is at least one budget.  In this case, any of the three above responses may
-    apply.
+[Configuring a Pod Disruption Budget](/docs/tasks/configure-pod-container/configure-pod-disruption-budget/)
@@ -1,50 +1,10 @@
 ---
 assignees:
- ArtfulCoder
 - davidopp
- lavalamp
-
+- thockin
+title: Using DNS Pods and Services
 ---

-## Introduction
-
-As of Kubernetes 1.3, DNS is a built-in service launched automatically using the addon manager [cluster add-on](http://releases.k8s.io/{{page.githubbranch}}/cluster/addons/README.md).
-A DNS Pod and Service will be scheduled on the cluster, and the kubelets will be
-configured to tell individual containers to use the DNS Service's IP to resolve DNS names.
-
-Every Service defined in the cluster (including the DNS server itself) will be
-assigned a DNS name.  By default, a client Pod's DNS search list will
-include the Pod's own namespace and the cluster's default domain.  This is best
-illustrated by example:
-
-Assume a Service named `foo` in the Kubernetes namespace `bar`.  A Pod running
-in namespace `bar` can look up this service by simply doing a DNS query for
-`foo`.  A Pod running in namespace `quux` can look up this service by doing a
-DNS query for `foo.bar`.
-
-The Kubernetes cluster DNS server (based off the [SkyDNS](https://github.com/skynetservices/skydns) library)
-supports forward lookups (A records), service lookups (SRV records) and reverse IP address lookups (PTR records).
-
-
-## How it Works
-
-The running Kubernetes DNS pod holds 3 containers - kubedns, dnsmasq and a health check called healthz.
-The kubedns process watches the Kubernetes master for changes in Services and Endpoints, and maintains
-in-memory lookup structures to service DNS requests. The dnsmasq container adds DNS caching to improve
-performance. The healthz container provides a single health check endpoint while performing dual healthchecks
-(for dnsmasq and kubedns).
-
-## Kubernetes Federation (Multiple Zone support)
-
-Release 1.3 introduced Cluster Federation support for multi-site
-Kubernetes installations. This required some minor
-(backward-compatible) changes to the way
-the Kubernetes cluster DNS server processes DNS queries, to facilitate
-the lookup of federated services (which span multiple Kubernetes clusters).
-See the [Cluster Federation Administrators' Guide](/docs/admin/federation) for more
-details on Cluster Federation and multi-site support.
-
-## References
-
- [Docs for the DNS cluster addon](http://releases.k8s.io/{{page.githubbranch}}/build/kube-dns/README.md)
+{% include user-guide-content-moved.md %}

+[DNS Pods and Services](/docs/concepts/services-networking/dns-pod-service/)
@@ -1,11 +1,10 @@
 ---
 assignees:
 - lavalamp
-
+title: Configuring Kubernetes Use of etcd
 ---

-
-[etcd](https://coreos.com/etcd/docs/2.2.1/) is a highly-available key value
+[etcd](https://coreos.com/etcd/docs/latest/) is a highly-available key value
 store which Kubernetes uses for persistent storage of all of its REST API
 objects.

@@ -21,7 +20,7 @@ Data Reliability: for reasonable safety, either etcd needs to be run as a
 etcd) or etcd's data directory should be located on durable storage (e.g., GCE's
 persistent disk). In either case, if high availability is required--as it might
 be in a production cluster--the data directory ought to be [backed up
-periodically](https://coreos.com/etcd/docs/2.2.1/admin_guide.html#disaster-recovery),
+periodically](https://coreos.com/etcd/docs/latest/op-guide/recovery.html),
 to reduce downtime in case of corruption.

 ## Default configuration
@@ -1,4 +1,6 @@
 ---
+title: federation-apiserver
+notitle: true
 ---

 ## federation-apiserver
@@ -20,10 +22,11 @@ federation-apiserver
 ### Options

 ```
-      --admission-control string                                Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, NamespaceLifecycle. (default "AlwaysAdmit")
+      --admission-control string                                Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, NamespaceLifecycle, OwnerReferencesPermissionEnforcement. (default "AlwaysAdmit")
      --admission-control-config-file string                    File with admission control configuration.
-      --advertise-address value                                 The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.
-      --apiserver-count int                                     The number of apiservers running in the cluster. (default 1)
+      --advertise-address ip                                    The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.
+      --anonymous-auth                                          Enables anonymous requests to the secure port of the API server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated. (default true)
+      --apiserver-count int                                     The number of apiservers running in the cluster. Must be a positive number. (default 1)
      --audit-log-maxage int                                    The maximum number of days to retain old audit log files based on the timestamp encoded in their filename.
      --audit-log-maxbackup int                                 The maximum number of old audit log files to retain.
      --audit-log-maxsize int                                   The maximum size in megabytes of the audit log file before it gets rotated. Defaults to 100MB.
@@ -35,64 +38,71 @@ federation-apiserver
      --authorization-webhook-cache-unauthorized-ttl duration   The duration to cache 'unauthorized' responses from the webhook authorizer. Default is 30s. (default 30s)
      --authorization-webhook-config-file string                File with webhook configuration in kubeconfig format, used with --authorization-mode=Webhook. The API server will query the remote service to determine access on the API server's secure port.
      --basic-auth-file string                                  If set, the file that will be used to admit requests to the secure port of the API server via http basic authentication.
-      --bind-address value                                      The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank, all interfaces will be used (0.0.0.0). (default 0.0.0.0)
+      --bind-address ip                                         The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank, all interfaces will be used (0.0.0.0). (default 0.0.0.0)
      --cert-dir string                                         The directory where the TLS certs are located (by default /var/run/kubernetes). If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored. (default "/var/run/kubernetes")
      --client-ca-file string                                   If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.
      --cloud-config string                                     The path to the cloud provider configuration file. Empty string for no configuration file.
      --cloud-provider string                                   The provider for cloud services. Empty string for no provider.
-      --cors-allowed-origins value                              List of allowed origins for CORS, comma separated.  An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled. (default [])
+      --contention-profiling                                    Enable contention profiling. Requires --profiling to be set to work.
+      --cors-allowed-origins stringSlice                        List of allowed origins for CORS, comma separated.  An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled.
      --delete-collection-workers int                           Number of workers spawned for DeleteCollection call. These are used to speed up namespace cleanup. (default 1)
-      --deserialization-cache-size int                          Number of deserialized json objects to cache in memory. (default 50000)
+      --deserialization-cache-size int                          Number of deserialized json objects to cache in memory.
+      --enable-garbage-collector                                Enables the generic garbage collector. MUST be synced with the corresponding flag of the kube-controller-manager. (default true)
      --enable-swagger-ui                                       Enables swagger ui on the apiserver at /swagger-ui
      --etcd-cafile string                                      SSL Certificate Authority file used to secure etcd communication.
      --etcd-certfile string                                    SSL certification file used to secure etcd communication.
      --etcd-keyfile string                                     SSL key file used to secure etcd communication.
      --etcd-prefix string                                      The prefix for all resource paths in etcd. (default "/registry")
      --etcd-quorum-read                                        If true, enable quorum read.
-      --etcd-servers value                                      List of etcd servers to connect with (http://ip:port), comma separated. (default [])
-      --etcd-servers-overrides value                            Per-resource etcd servers overrides, comma separated. The individual override format: group/resource#servers, where servers are http://ip:port, semicolon separated. (default [])
+      --etcd-servers stringSlice                                List of etcd servers to connect with (scheme://ip:port), comma separated.
+      --etcd-servers-overrides stringSlice                      Per-resource etcd servers overrides, comma separated. The individual override format: group/resource#servers, where servers are http://ip:port, semicolon separated.
      --event-ttl duration                                      Amount of time to retain events. Default is 1h. (default 1h0m0s)
+      --experimental-keystone-ca-file string                    If set, the Keystone server's certificate will be verified by one of the authorities in the experimental-keystone-ca-file, otherwise the host's root CA set will be used.
      --experimental-keystone-url string                        If passed, activates the keystone authentication plugin.
      --external-hostname string                                The hostname to use when generating externalized URLs for this master (e.g. Swagger API Docs).
-      --feature-gates value                                     A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --feature-gates mapStringBool                             A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
 AllAlpha=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
 AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
-      --insecure-bind-address value                             The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all interfaces). Defaults to localhost. (default 127.0.0.1)
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
+StreamingProxyRedirects=true|false (ALPHA - default=false)
+      --insecure-allow-any-token username/group1,group2         If set, your server will be INSECURE.  Any token will be allowed and user information will be parsed from the token as username/group1,group2
+      --insecure-bind-address ip                                The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all interfaces). Defaults to localhost. (default 127.0.0.1)
      --insecure-port int                                       The port on which to serve unsecured, unauthenticated access. Default 8080. It is assumed that firewall rules are set up such that this port is not reachable from outside of the cluster and that port 443 on the cluster's public address is proxied to this port. This is performed by nginx in the default setup. (default 8080)
      --kubernetes-service-node-port int                        If non-zero, the Kubernetes master service (which apiserver creates/maintains) will be of type NodePort, using this as the value of the port. If zero, the Kubernetes master service will be of type ClusterIP.
      --long-running-request-regexp string                      A regular expression matching long running requests which should be excluded from maximum inflight request handling. (default "(/|^)((watch|proxy)(/|$)|(logs?|portforward|exec|attach)/?$)")
-      --master-service-namespace string                         The namespace from which the kubernetes master services should be injected into pods. (default "default")
+      --master-service-namespace string                         DEPRECATED: the namespace from which the kubernetes master services should be injected into pods. (default "default")
      --max-requests-inflight int                               The maximum number of requests in flight at a given time. When the server exceeds this, it rejects requests. Zero for no limit. (default 400)
      --min-request-timeout int                                 An optional field indicating the minimum number of seconds a handler must keep a request open before timing it out. Currently only honored by the watch request handler, which picks a randomized value above this number as the connection timeout, to spread out load. (default 1800)
      --oidc-ca-file string                                     If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file, otherwise the host's root CA set will be used.
      --oidc-client-id string                                   The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set.
-      --oidc-groups-claim string                                If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be an array of strings. This flag is experimental, please see the authentication documentation for further details.
+      --oidc-groups-claim string                                If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be a string or array of strings. This flag is experimental, please see the authentication documentation for further details.
      --oidc-issuer-url string                                  The URL of the OpenID issuer, only HTTPS scheme will be accepted. If set, it will be used to verify the OIDC JSON Web Token (JWT).
      --oidc-username-claim string                              The OpenID claim to use as the user name. Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. This flag is experimental, please see the authentication documentation for further details. (default "sub")
      --profiling                                               Enable profiling via web interface host:port/debug/pprof/ (default true)
-      --runtime-config value                                    A set of key=value pairs that describe runtime configuration that may be passed to apiserver. apis/<groupVersion> key can be used to turn on/off specific api versions. apis/<groupVersion>/<resource> can be used to turn on/off specific resources. api/all and api/legacy are special keys to control all and legacy api versions respectively.
+      --requestheader-allowed-names stringSlice                 List of client certificate common names to allow to provide usernames in headers specified by --requestheader-username-headers. If empty, any client certificate validated by the authorities in --requestheader-client-ca-file is allowed.
+      --requestheader-client-ca-file string                     Root certificate bundle to use to verify client certificates on incoming requests before trusting usernames in headers specified by --requestheader-username-headers
+      --requestheader-username-headers stringSlice              List of request headers to inspect for usernames. X-Remote-User is common.
+      --runtime-config mapStringString                          A set of key=value pairs that describe runtime configuration that may be passed to apiserver. apis/<groupVersion> key can be used to turn on/off specific api versions. apis/<groupVersion>/<resource> can be used to turn on/off specific resources. api/all and api/legacy are special keys to control all and legacy api versions respectively.
      --secure-port int                                         The port on which to serve HTTPS with authentication and authorization. If 0, don't serve HTTPS at all. (default 6443)
-      --service-cluster-ip-range value                          A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes for pods.
-      --service-node-port-range value                           A port range to reserve for services with NodePort visibility. Example: '30000-32767'. Inclusive at both ends of the range. (default 30000-32767)
+      --service-cluster-ip-range ipNet                          A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes for pods.
+      --service-node-port-range portRange                       A port range to reserve for services with NodePort visibility. Example: '30000-32767'. Inclusive at both ends of the range. (default 30000-32767)
      --storage-backend string                                  The storage backend for persistence. Options: 'etcd2' (default), 'etcd3'.
      --storage-media-type string                               The media type to use to store objects in storage. Defaults to application/json. Some resources may only support a specific media type and will ignore this setting. (default "application/json")
-      --storage-versions string                                 The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1alpha1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,federation/v1beta1,policy/v1alpha1,rbac.authorization.k8s.io/v1alpha1,v1")
+      --storage-versions string                                 The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1beta1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates.k8s.io/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,federation/v1beta1,policy/v1beta1,rbac.authorization.k8s.io/v1alpha1,storage.k8s.io/v1beta1,v1")
      --target-ram-mb int                                       Memory limit for apiserver in MB (used to configure sizes of caches, etc.)
-      --tls-cert-file string                                    File containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.
-      --tls-private-key-file string                             File containing x509 private key matching --tls-cert-file.
+      --tls-ca-file string                                      If set, this certificate authority will used for secure access from Admission Controllers. This must be a valid PEM-encoded CA bundle.
+      --tls-cert-file string                                    File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.
+      --tls-private-key-file string                             File containing the default x509 private key matching --tls-cert-file.
+      --tls-sni-cert-key namedCertKey                           A pair of x509 certificate and private key file paths, optionally suffixed with a list of domain patterns which are fully qualified domain names, possibly with prefixed wildcard segments. If no domain patterns are provided, the names of the certificate are extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns trump over extracted names. For multiple key/certificate pairs, use the --tls-sni-cert-key multiple times. Examples: "example.key,example.crt" or "*.foo.com,foo.com:foo.key,foo.crt". (default [])
      --token-auth-file string                                  If set, the file that will be used to secure the secure port of the API server via token authentication.
      --watch-cache                                             Enable watch caching in the apiserver (default true)
-      --watch-cache-sizes value                                 List of watch cache sizes for every resource (pods, nodes, etc.), comma separated. The individual override format: resource#size, where size is a number. It takes effect when watch-cache is enabled. (default [])
+      --watch-cache-sizes stringSlice                           List of watch cache sizes for every resource (pods, nodes, etc.), comma separated. The individual override format: resource#size, where size is a number. It takes effect when watch-cache is enabled.
 ```

-###### Auto generated by spf13/cobra on 2-Sep-2016
-
-
-
-
+###### Auto generated by spf13/cobra on 13-Dec-2016


 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
@@ -1,4 +1,6 @@
 ---
+title: federation-controller-manager
+notitle: true
 ---

 ## federation-controller-manager
@@ -23,14 +25,14 @@ federation-controller-manager
 ### Options

 ```
-      --address value                          The IP address to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
+      --address ip                             The IP address to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
      --cluster-monitor-period duration        The period for syncing ClusterStatus in ClusterController. (default 40s)
      --concurrent-replicaset-syncs int        The number of ReplicaSets syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load (default 10)
      --concurrent-service-syncs int           The number of service syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load (default 10)
-      --dns-provider string                    DNS provider. Valid values are: ["aws-route53" "google-clouddns"]
+      --dns-provider string                    DNS provider. Valid values are: ["google-clouddns" "aws-route53"]
      --dns-provider-config string             Path to config file for configuring DNS provider.
      --federated-api-burst int                Burst to use while talking with federation apiserver (default 30)
-      --federated-api-qps value                QPS to use while talking with federation apiserver (default 20)
+      --federated-api-qps float32              QPS to use while talking with federation apiserver (default 20)
      --federation-name string                 Federation name.
      --kube-api-content-type string           ContentType of requests sent to apiserver. Passing application/vnd.kubernetes.protobuf is an experimental feature now.
      --kubeconfig string                      Path to kubeconfig file with authorization and master location information.
@@ -41,14 +43,12 @@ federation-controller-manager
      --master string                          The address of the federation API server (overrides any value in kubeconfig)
      --port int                               The port that the controller-manager's http service runs on (default 10253)
      --profiling                              Enable profiling via web interface host:port/debug/pprof/ (default true)
+      --service-dns-suffix string              DNS Suffix to use when publishing federated service names.  Defaults to zone-name
+      --zone-id string                         Zone ID, needed if the zone name is not unique.
      --zone-name string                       Zone name, like example.com.
 ```

-###### Auto generated by spf13/cobra on 2-Sep-2016
-
-
-
-
+###### Auto generated by spf13/cobra on 13-Dec-2016


 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
@@ -3,8 +3,9 @@ assignees:
 - madhusudancs
 - mml
 - nikhiljindal
-
+title: Using `federation-up` and `deploy.sh`
 ---
+
 This guide explains how to set up cluster federation that lets us control multiple Kubernetes clusters.


@@ -14,11 +15,11 @@ This guide explains how to set up cluster federation that lets us control multip
 ## Prerequisites

 This guide assumes that you have a running Kubernetes cluster.
-If not, then head over to the [getting started guides](/docs/getting-started-guides/) to bring up a cluster.
+If you need to start a new cluster, see the [getting started guides](/docs/getting-started-guides/) for instructions on bringing a cluster up.

-This guide also assumes that you have a Kubernetes release
-[downloaded from here](/docs/getting-started-guides/binary_release/),
-extracted into a directory and all the commands in this guide are run from
+To use the commands in this guide, you must download a Kubernetes release from the 
+[getting started binary releases](/docs/getting-started-guides/binary_release/) and 
+extract into a directory; all the commands in this guide are run from
 that directory.

 ```shell
@@ -26,8 +27,8 @@ $ curl -L https://github.com/kubernetes/kubernetes/releases/download/v1.4.0/kube
 $ cd kubernetes
 ```

-This guide also assumes that you have an installation of Docker running
-locally, i.e. on the machine where you run the commands described in this
+You must also have a Docker installation running
+locally--meaning on the machine where you run the commands described in this
 guide.

 ## Setting up a federation control plane
@@ -109,7 +110,7 @@ $ KUBE_REGISTRY="gcr.io/myrepository" federation/develop/develop.sh build_image
 $ KUBE_REGISTRY="gcr.io/myrepository" federation/develop/develop.sh push
 ```

-Note: This is going to overwite the values you might have set for
+Note: This is going to overwrite the values you might have set for
 `apiserverRegistry`, `apiserverVersion`, `controllerManagerRegistry` and
 `controllerManagerVersion` in your `${FEDERATION_OUTPUT_ROOT}/values.yaml`
 file. Hence, it is not recommend to customize these values in
@@ -212,47 +213,81 @@ cluster1   Ready               3m

 ## Updating KubeDNS

-Once the cluster is registered with the federation, you are all set to use it.
-But for the cluster to be able to route federation service requests, you need to restart
-KubeDNS and pass it a `--federations` flag which tells it about valid federation DNS hostnames.
-Format of the flag is like this:
+Once you've registered your cluster with the federation, you'll need to update KubeDNS so that your cluster can route federation service requests. The update method varies depending on your Kubernetes version; on Kubernetes 1.5 or later, you must pass the
+`--federations` flag to kube-dns via the kube-dns config map. In version 1.4 or earlier, you must set the `--federations` flag directly on kube-dns-rc on other clusters.
+
+### Kubernetes 1.5+: Passing federations flag via config map to kube-dns
+
+For Kubernetes clusters of version 1.5+, you can pass the
+`--federations` flag to kube-dns via the kube-dns config map.
+The flag uses the following format:

 ```
 --federations=${FEDERATION_NAME}=${DNS_DOMAIN_NAME}
 ```

-To update KubeDNS with federations flag, you can edit the existing kubedns replication controller to
-include that flag in pod template spec and then delete the existing pod. Replication controller will
-recreate the pod with updated template.
+To pass this flag to KubeDNS, create a config-map with name `kube-dns` in
+namespace `kube-system`. The configmap should look like the following:

-To find the name of existing kubedns replication controller, run
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kube-dns
+  namespace: kube-system
+data:
+  federations: <federation-name>=<federation-domain-name>
+```
+
+where `<federation-name>` should be replaced by the name you want to give to your
+federation, and
+`federation-domain-name` should be replaced by the domain name you want to use
+in your federation DNS.
+
+You can find more details about config maps in general at
+[config map](http://kubernetes.io/docs/user-guide/configmap/).
+
+### Kubernetes 1.4 and earlier: Setting federations flag on kube-dns-rc
+
+If your cluster is running Kubernetes version 1.4 or earlier, you must restart
+KubeDNS and pass it a `--federations` flag, which tells it about valid federation DNS hostnames.
+The flag uses the following format:
+
+```
+--federations=${FEDERATION_NAME}=${DNS_DOMAIN_NAME}
+```
+
+To update KubeDNS with the `--federations` flag, you can edit the existing kubedns replication controller to
+include that flag in pod template spec, and then delete the existing pod. The replication controller then
+recreates the pod with updated template.
+
+To find the name of existing kubedns replication controller, run the following command:

 ```shell
 $ kubectl get rc --namespace=kube-system
 ```

-This will list all the replication controllers. Name of the kube-dns replication
-controller will look like `kube-dns-v18`. You can then edit it by running:
+You should see a list of all the replication controllers on the cluster. The kube-dns replication
+controller should have a name similar to `kube-dns-v18`. To edit the replication controller, specify it by name as follows:

 ```shell
 $ kubectl edit rc <rc-name> --namespace=kube-system
 ```
-Add the `--federations` flag as args to kube-dns container in the YAML file that
-pops up after running the above command.
+In the resulting YAML file for the kube-dns replication controller, add the `--federations` flag as an argument to kube-dns container.

-To delete the existing kube dns pod, you can first find it by running:
+Then, you must delete the existing kube dns pod. You can find the pod by running:

 ```shell
 $ kubectl get pods --namespace=kube-system
 ```

-And then delete it by running:
+And then delete the appropriate pod by running:

 ```shell
 $ kubectl delete pods <pod-name> --namespace=kube-system
 ```

-You are now all set to start using federation.
+Once you've completed the kube-dns configuration, your federation is ready for use.

 ## Turn down

@@ -317,7 +352,7 @@ $ KUBERNETES_PROVIDER=gce FEDERATION_DNS_PROVIDER=google-clouddns FEDERATION_NAM
 set appropriately if it is missing and `KUBERNETES_PROVIDER` is one of `gce`, `gke` and `aws`.
 This is used to resolve DNS requests for federation services. The service
 controller keeps DNS records with the provider updated as services/pods are
-updated in underlying kubernetes clusters.
+updated in underlying Kubernetes clusters.

 `FEDERATION_NAME` is a name you can choose for your federation. This is the name that will appear in DNS routes.

@@ -0,0 +1,9 @@
+---
+assignees:
+- madhusudancs
+title: Setting up Cluster Federation with Kubefed
+---
+
+{% include user-guide-content-moved.md %}
+
+[Setting up Cluster Federation with kubefed](/docs/tutorials/federation/set-up-cluster-federation-kubefed/)
@@ -1,32 +1,32 @@
 ---
 assignees:
 - mikedanese
-
+title: Configuring kubelet Garbage Collection
 ---

 * TOC
 {:toc}

-Garbage collection is a helpful function of kubelet that will clean up unused images and unused containers. kubelet will perform garbage collection for containers every minute and garbage collection for images every five minutes.
+Garbage collection is a helpful function of kubelet that will clean up unused images and unused containers. Kubelet will perform garbage collection for containers every minute and garbage collection for images every five minutes.

 External garbage collection tools are not recommended as these tools can potentially break the behavior of kubelet by removing containers expected to exist.

 ### Image Collection

-kubernetes manages lifecycle of all images through imageManager, with the cooperation
+Kubernetes manages lifecycle of all images through imageManager, with the cooperation
 of cadvisor.

 The policy for garbage collecting images takes two factors into consideration:
-`HighThresholdPercent` and `LowThresholdPercent`. Disk usage above the the high threshold
+`HighThresholdPercent` and `LowThresholdPercent`. Disk usage above the high threshold
 will trigger garbage collection. The garbage collection will delete least recently used images until the low
 threshold has been met.

 ### Container Collection

-The policy for garbage collecting containers considers three user-defined variables. `MinAge` is the minimum age at which a container can be garbage collected. `MaxPerPodContainer` is the maximum number of dead containers any single
-pod (UID, container name) pair is allowed to have. `MaxContainers` is the maximum number of total dead containers. These variables can be individually disabled by setting 'Min Age' to zero and setting 'MaxPerPodContainer' and 'MaxContainers' respectively to less than zero.
+The policy for garbage collecting containers considers three user-defined variables. `MinAge` is the minimum age at which a container can be garbage collected. `MaxPerPodContainer` is the maximum number of dead containers every single
+pod (UID, container name) pair is allowed to have. `MaxContainers` is the maximum number of total dead containers. These variables can be individually disabled by setting `MinAge` to zero and setting `MaxPerPodContainer` and `MaxContainers` respectively to less than zero.

-Kubelet will act on containers that are unidentified, deleted, or outside of the boundaries set by the previously mentioned flags. The oldest containers will generally be removed first. 'MaxPerPodContainer' and 'MaxContainer' may potentially conflict with each other in situations where retaining the maximum number of containers per pod ('MaxPerPodContainer') would go outside the allowable range of global dead containers ('MaxContainers'). 'MaxPerPodContainer' would be adjusted in this situation: A worst case scenario would be to downgrade 'MaxPerPodContainer' to 1 and evict the oldest containers. Additionally, containers owned by pods that have been deleted are removed once they are older than `MinAge`.
+Kubelet will act on containers that are unidentified, deleted, or outside of the boundaries set by the previously mentioned flags. The oldest containers will generally be removed first. `MaxPerPodContainer` and `MaxContainer` may potentially conflict with each other in situations where retaining the maximum number of containers per pod (`MaxPerPodContainer`) would go outside the allowable range of global dead containers (`MaxContainers`). `MaxPerPodContainer` would be adjusted in this situation: A worst case scenario would be to downgrade `MaxPerPodContainer` to 1 and evict the oldest containers. Additionally, containers owned by pods that have been deleted are removed once they are older than `MinAge`.

 Containers that are not managed by kubelet are not subject to container garbage collection.

@@ -42,15 +42,34 @@ to free. Default is 80%.
 We also allow users to customize garbage collection policy through the following kubelet flags:

 1. `minimum-container-ttl-duration`, minimum age for a finished container before it is
-garbage collected. Default is 1 minute.
-2. `maximum-dead-containers-per-container`, maximum number of old instances to retain
-per container. Default is 2.
+garbage collected. Default is 0 minute, which means every finished container will be garbaged collected.
+2. `maximum-dead-containers-per-container`, maximum number of old instances to be retained
+per container. Default is 1.
 3. `maximum-dead-containers`, maximum number of old instances of containers to retain globally.
-Default is 100.
+Default is -1, which means there is no global limit.

 Containers can potentially be garbage collected before their usefulness has expired. These containers
 can contain logs and other data that can be useful for troubleshooting. A sufficiently large value for
-`maximum-dead-containers-per-container` is highly recommended to allow at least 2 dead containers to be
-retained per expected container. A higher value for `maximum-dead-containers` is also recommended for a
-similiar reason.
+`maximum-dead-containers-per-container` is highly recommended to allow at least 1 dead container to be
+retained per expected container. A larger value for `maximum-dead-containers` is also recommended for a
+similar reason.
 See [this issue](https://github.com/kubernetes/kubernetes/issues/13287) for more details.
+
+
+### Deprecation
+
+Some kubelet Garbage Collection features in this doc will be replaced by kubelet eviction in the future.
+
+Including:
+
+| Existing Flag | New Flag | Rationale |
+| ------------- | -------- | --------- |
+| `--image-gc-high-threshold` | `--eviction-hard` or `--eviction-soft` | existing eviction signals can trigger image garbage collection |
+| `--image-gc-low-threshold` | `--eviction-minimum-reclaim` | eviction reclaims achieve the same behavior |
+| `--maximum-dead-containers` | | deprecated once old logs are stored outside of container's context |
+| `--maximum-dead-containers-per-container` | | deprecated once old logs are stored outside of container's context |
+| `--minimum-container-ttl-duration` | | deprecated once old logs are stored outside of container's context |
+| `--low-diskspace-threshold-mb` | `--eviction-hard` or `eviction-soft` | eviction generalizes disk thresholds to other resources |
+| `--outofdisk-transition-frequency` | `--eviction-pressure-transition-period` | eviction generalizes disk pressure transition to other resources |
+
+See [Configuring Out Of Resource Handling](/docs/admin/out-of-resource/) for more details.
@@ -0,0 +1,158 @@
+---
+assignees:
+- jszczepkowski
+title: Setting up High-Availability Kubernetes Masters
+---
+
+* TOC
+{:toc}
+
+Kubernetes version 1.5 adds alpha support for replicating Kubernetes masters in `kube-up` or `kube-down` scripts for Google Compute Engine.
+This document describes how to use kube-up/down scripts to manage highly available (HA) masters and how HA masters are implemented for use with GCE.
+
+## Starting an HA-compatible cluster
+
+To create a new HA-compatible cluster, you must set the following flags in your `kube-up` script:
+
+* `MULTIZONE=true` - to prevent removal of master replicas kubelets from zones different than server's default zone.
+Required if you want to run master replicas in different zones, which is recommended.
+
+* `ENABLE_ETCD_QUORUM_READS=true` - to ensure that reads from all API servers will return most up-to-date data.
+If true, reads will be directed to leader etcd replica.
+Setting this value to true is optional: reads will be more reliable but will also be slower.
+
+Optionally, you can specify a GCE zone where the first master replica is to be created.
+Set the following flag:
+
+* `KUBE_GCE_ZONE=zone` - zone where the first master replica will run.
+
+The following sample command sets up a HA-compatible cluster in the GCE zone europe-west1-b:
+
+```shell
+$ MULTIZONE=true KUBE_GCE_ZONE=europe-west1-b  ENABLE_ETCD_QUORUM_READS=true ./cluster/kube-up.sh
+```
+
+Note that the commands above create a cluster with one master;
+however, you can add new master replicas to the cluster with subsequent commands.
+
+## Adding a new master replica
+
+After you have created an HA-compatible cluster, you can add master replicas to it.
+You add master replicas by using a `kube-up` script with the following flags:
+
+* `KUBE_REPLICATE_EXISTING_MASTER=true` - to create a replica of an existing
+master.
+
+* `KUBE_GCE_ZONE=zone` - zone where the master replica will run.
+Must be in the same region as other replicas' zones.
+
+You don't need to set the `MULTIZONE` or `ENABLE_ETCD_QUORUM_READS` flags,
+as those are inherited from when you started your HA-compatible cluster.
+
+The following sample command replicates the master on an existing HA-compatible cluster:
+
+```shell
+$ KUBE_GCE_ZONE=europe-west1-c KUBE_REPLICATE_EXISTING_MASTER=true ./cluster/kube-up.sh
+```
+
+## Removing a master replica
+
+You can remove a master replica from an HA cluster by using a `kube-down` script with the following flags:
+
+* `KUBE_DELETE_NODES=false` - to restrain deletion of kubelets.
+
+* `KUBE_GCE_ZONE=zone` - the zone from where master replica will be removed.
+ 
+* `KUBE_REPLICA_NAME=replica_name` - (optional) the name of master replica to remove.
+If empty: any replica from the given zone will be removed.
+
+The following sample command removes a master replica from an existing HA cluster:
+
+```shell
+$ KUBE_DELETE_NODES=false KUBE_GCE_ZONE=europe-west1-c ./cluster/kube-down.sh
+```
+
+## Handling master replica failures
+
+If one of the master replicas in your HA cluster fails,
+the best practice is to remove the replica from your cluster and add a new replica in the same zone.
+The following sample commands demonstrate this process:
+
+1. Remove the broken replica:
+
+```shell
+$ KUBE_DELETE_NODES=false KUBE_GCE_ZONE=replica_zone KUBE_REPLICA_NAME=replica_name ./cluster/kube-down.sh
+```
+
+<ol start="2"><li>Add a new replica in place of the old one:</li></ol>
+
+```shell
+$ KUBE_GCE_ZONE=replica-zone KUBE_REPLICATE_EXISTING_MASTER=true ./cluster/kube-up.sh
+```
+
+## Best practices for replicating masters for HA clusters
+
+* Try to place masters replicas in different zones. During a zone failure, all master placed inside the zone will fail.
+To survive zone failure, also place nodes in multiple zones
+(see [multiple-zones](http://kubernetes.io/docs/admin/multiple-zones/) for details).
+
+* Do not use a cluster with two master replicas. Consensus on a two replica cluster requires both replicas running when changing persistent state.
+As a result, both replicas are needed and a failure of any replica turns cluster into majority failure state.
+A two-replica cluster is thus inferior, in terms of HA, to a single replica cluster.
+
+* When you add a master replica, cluster state (etcd) is copied to a new instance.
+If the cluster is large, it may take a long time to duplicate its state.
+This operation may be sped up by migrating etcd data directory, as described [here](https://coreos.com/etcd/docs/latest/admin_guide.html#member-migration) 
+(we are considering adding support for etcd data dir migration in future).
+
+## Implementation notes
+
+![ha-master-gce](/images/docs/ha-master-gce.png)
+
+### Overview
+
+Each of master replicas will run the following components in the following mode:
+
+* etcd instance: all instances will be clustered together using consensus;
+
+* API server: each server will talk to local etcd - all API servers in the cluster will be available;
+
+* controllers, scheduler, and cluster auto-scaler: will use lease mechanism - only one instance of each of them will be active in the cluster;
+
+* add-on manager: each manager will work independently trying to keep add-ons in sync.
+
+In addition, there will be a load balancer in front of API servers that will route external and internal traffic to them.
+
+### Load balancing
+
+When starting the second master replica, a load balancer containing the two replicas will be created
+and the IP address of the first replica will be promoted to IP address of load balancer.
+Similarly, after removal of the penultimate master replica, the load balancer will be removed and its IP address will be assigned to the last remaining replica.
+Please note that creation and removal of load balancer are complex operations and it may take some time (~20 minutes) for them to propagate.
+
+### Master service & kubelets
+
+Instead of trying to keep an up-to-date list of Kubernetes apiserver in the Kubernetes service,
+the system directs all traffic to the external IP:
+
+* in one master cluster the IP points to the single master,
+
+* in multi-master cluster the IP points to the load balancer in-front of the masters.
+
+Similarly, the external IP will be used by kubelets to communicate with master.
+
+### Master certificates
+
+Kubernetes generates Master TLS certificates for the external public IP and local IP for each replica.
+There are no certificates for the ephemeral public IP for replicas;
+to access a replica via its ephemeral public IP, you must skip TLS verification.
+
+### Clustering etcd
+
+To allow etcd clustering, ports needed to communicate between etcd instances will be opened (for inside cluster communication).
+To make such deployment secure, communication between etcd instances is authorized using SSL.
+
+## Additional reading
+
+[Automated HA master deployment - design doc](https://github.com/kubernetes/kubernetes/blob/master/docs/design/ha_master.md)
+
@@ -1,7 +1,7 @@
---
-
---
-
+---
+title: Building High-Availability Clusters
+---
+
 ## Introduction

 This document describes how to build a high-availability (HA) Kubernetes cluster.  This is a fairly advanced topic.
@@ -100,16 +100,15 @@ for `${NODE_IP}` on each machine.

 #### Validating your cluster

-Once you copy this into all three nodes, you should have a clustered etcd set up.  You can validate with
-
+Once you copy this into all three nodes, you should have a clustered etcd set up.  You can validate on master with
 ```shell
-etcdctl member list
+kubectl exec < pod_name > etcdctl member list
 ```

 and

 ```shell
-etcdctl cluster-health
+kubectl exec < pod_name > etcdctl cluster-health
 ```

 You can also validate that this is working with `etcdctl set foo bar` on one node, and `etcdctl get foo`
@@ -1,86 +1,7 @@
 ---
-assignees:
- davidopp
- lavalamp
-
+title: Admin Guide
 ---

-The cluster admin guide is for anyone creating or administering a Kubernetes cluster.
-It assumes some familiarity with concepts in the [User Guide](/docs/user-guide/).
+{% include user-guide-content-moved.md %}

-* TOC
-{:toc}
-
-## Planning a cluster
-
-There are many different examples of how to setup a kubernetes cluster.  Many of them are listed in this
-[matrix](/docs/getting-started-guides/).  We call each of the combinations in this matrix a *distro*.
-
-Before choosing a particular guide, here are some things to consider:
-
- - Are you just looking to try out Kubernetes on your laptop, or build a high-availability many-node cluster? Both
-   models are supported, but some distros are better for one case or the other.
- - Will you be using a hosted Kubernetes cluster, such as [GKE](https://cloud.google.com/container-engine), or setting
-   one up yourself?
- - Will your cluster be on-premises, or in the cloud (IaaS)?  Kubernetes does not directly support hybrid clusters.  We
-   recommend setting up multiple clusters rather than spanning distant locations.
- - Will you be running Kubernetes on "bare metal" or virtual machines?  Kubernetes supports both, via different distros.
- - Do you just want to run a cluster, or do you expect to do active development of kubernetes project code?  If the
-   latter, it is better to pick a distro actively used by other developers.  Some distros only use binary releases, but
-   offer is a greater variety of choices.
- - Not all distros are maintained as actively.  Prefer ones which are listed as tested on a more recent version of
-   Kubernetes.
- - If you are configuring kubernetes on-premises, you will need to consider what [networking
-   model](/docs/admin/networking) fits best.
- - If you are designing for very high-availability, you may want [clusters in multiple zones](/docs/admin/multi-cluster).
- - You may want to familiarize yourself with the various
-   [components](/docs/admin/cluster-components) needed to run a cluster.
-
-## Setting up a cluster
-
-Pick one of the Getting Started Guides from the [matrix](/docs/getting-started-guides/) and follow it.
-If none of the Getting Started Guides fits, you may want to pull ideas from several of the guides.
-
-One option for custom networking is *OpenVSwitch GRE/VxLAN networking* ([ovs-networking.md](/docs/admin/ovs-networking)), which
-uses OpenVSwitch to set up networking between pods across
-  Kubernetes nodes.
-
-If you are modifying an existing guide which uses Salt, this document explains [how Salt is used in the Kubernetes
-project](/docs/admin/salt).
-
-## Managing a cluster, including upgrades
-
-[Managing a cluster](/docs/admin/cluster-management).
-
-## Managing nodes
-
-[Managing nodes](/docs/admin/node).
-
-## Optional Cluster Services
-
-* **DNS Integration with SkyDNS** ([dns.md](/docs/admin/dns)):
-  Resolving a DNS name directly to a Kubernetes service.
-
-* **Logging** with [Kibana](/docs/user-guide/logging)
-
-## Multi-tenant support
-
-* **Resource Quota** ([resourcequota/](/docs/admin/resourcequota/))
-
-## Security
-
-* **Kubernetes Container Environment** ([docs/user-guide/container-environment.md](/docs/user-guide/container-environment)):
-  Describes the environment for Kubelet managed containers on a Kubernetes
-  node.
-
-* **Securing access to the API Server** [accessing the api](/docs/admin/accessing-the-api)
-
-* **Authentication**  [authentication](/docs/admin/authentication)
-
-* **Authorization** [authorization](/docs/admin/authorization)
-
-* **Admission Controllers** [admission controllers](/docs/admin/admission-controllers)
-
-* **Sysctls** [sysctls](/docs/admin/sysctls.md)
-
-* **Audit** [audit](/docs/admin/audit)
+[Cluster Administration Overview](/docs/tasks/administer-cluster/overview/)
@@ -1,4 +1,6 @@
 ---
+title: kube-apiserver
+notitle: true
 ---

 ## kube-apiserver
@@ -20,11 +22,12 @@ kube-apiserver
 ### Options

 ```
-      --admission-control string                                Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, DefaultStorageClass, DenyEscalatingExec, DenyExecOnPrivileged, ImagePolicyWebhook, InitialResources, LimitPodHardAntiAffinityTopology, LimitRanger, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, PersistentVolumeLabel, PodSecurityPolicy, ResourceQuota, SecurityContextDeny, ServiceAccount. (default "AlwaysAdmit")
+      --admission-control string                                Ordered list of plug-ins to do admission control of resources into cluster. Comma-delimited list of: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, DefaultStorageClass, DenyEscalatingExec, DenyExecOnPrivileged, ImagePolicyWebhook, InitialResources, LimitPodHardAntiAffinityTopology, LimitRanger, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, OwnerReferencesPermissionEnforcement, PersistentVolumeLabel, PodNodeSelector, PodSecurityPolicy, ResourceQuota, SecurityContextDeny, ServiceAccount. (default "AlwaysAdmit")
      --admission-control-config-file string                    File with admission control configuration.
-      --advertise-address value                                 The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.
+      --advertise-address ip                                    The IP address on which to advertise the apiserver to members of the cluster. This address must be reachable by the rest of the cluster. If blank, the --bind-address will be used. If --bind-address is unspecified, the host's default interface will be used.
      --allow-privileged                                        If true, allow privileged containers.
-      --apiserver-count int                                     The number of apiservers running in the cluster. (default 1)
+      --anonymous-auth                                          Enables anonymous requests to the secure port of the API server. Requests that are not rejected by another authentication method are treated as anonymous requests. Anonymous requests have a username of system:anonymous, and a group name of system:unauthenticated. (default true)
+      --apiserver-count int                                     The number of apiservers running in the cluster. Must be a positive number. (default 1)
      --audit-log-maxage int                                    The maximum number of days to retain old audit log files based on the timestamp encoded in their filename.
      --audit-log-maxbackup int                                 The maximum number of old audit log files to retain.
      --audit-log-maxsize int                                   The maximum size in megabytes of the audit log file before it gets rotated. Defaults to 100MB.
@@ -38,14 +41,15 @@ kube-apiserver
      --authorization-webhook-cache-unauthorized-ttl duration   The duration to cache 'unauthorized' responses from the webhook authorizer. Default is 30s. (default 30s)
      --authorization-webhook-config-file string                File with webhook configuration in kubeconfig format, used with --authorization-mode=Webhook. The API server will query the remote service to determine access on the API server's secure port.
      --basic-auth-file string                                  If set, the file that will be used to admit requests to the secure port of the API server via http basic authentication.
-      --bind-address value                                      The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank, all interfaces will be used (0.0.0.0). (default 0.0.0.0)
+      --bind-address ip                                         The IP address on which to listen for the --secure-port port. The associated interface(s) must be reachable by the rest of the cluster, and by CLI/web clients. If blank, all interfaces will be used (0.0.0.0). (default 0.0.0.0)
      --cert-dir string                                         The directory where the TLS certs are located (by default /var/run/kubernetes). If --tls-cert-file and --tls-private-key-file are provided, this flag will be ignored. (default "/var/run/kubernetes")
      --client-ca-file string                                   If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.
      --cloud-config string                                     The path to the cloud provider configuration file. Empty string for no configuration file.
      --cloud-provider string                                   The provider for cloud services. Empty string for no provider.
-      --cors-allowed-origins value                              List of allowed origins for CORS, comma separated.  An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled. (default [])
+      --contention-profiling                                    Enable contention profiling. Requires --profiling to be set to work.
+      --cors-allowed-origins stringSlice                        List of allowed origins for CORS, comma separated.  An allowed origin can be a regular expression to support subdomain matching. If this list is empty CORS will not be enabled.
      --delete-collection-workers int                           Number of workers spawned for DeleteCollection call. These are used to speed up namespace cleanup. (default 1)
-      --deserialization-cache-size int                          Number of deserialized json objects to cache in memory. (default 50000)
+      --deserialization-cache-size int                          Number of deserialized json objects to cache in memory.
      --enable-garbage-collector                                Enables the generic garbage collector. MUST be synced with the corresponding flag of the kube-controller-manager. (default true)
      --enable-swagger-ui                                       Enables swagger ui on the apiserver at /swagger-ui
      --etcd-cafile string                                      SSL Certificate Authority file used to secure etcd communication.
@@ -53,62 +57,75 @@ kube-apiserver
      --etcd-keyfile string                                     SSL key file used to secure etcd communication.
      --etcd-prefix string                                      The prefix for all resource paths in etcd. (default "/registry")
      --etcd-quorum-read                                        If true, enable quorum read.
-      --etcd-servers value                                      List of etcd servers to connect with (http://ip:port), comma separated. (default [])
-      --etcd-servers-overrides value                            Per-resource etcd servers overrides, comma separated. The individual override format: group/resource#servers, where servers are http://ip:port, semicolon separated. (default [])
+      --etcd-servers stringSlice                                List of etcd servers to connect with (scheme://ip:port), comma separated.
+      --etcd-servers-overrides stringSlice                      Per-resource etcd servers overrides, comma separated. The individual override format: group/resource#servers, where servers are http://ip:port, semicolon separated.
      --event-ttl duration                                      Amount of time to retain events. Default is 1h. (default 1h0m0s)
+      --experimental-keystone-ca-file string                    If set, the Keystone server's certificate will be verified by one of the authorities in the experimental-keystone-ca-file, otherwise the host's root CA set will be used.
      --experimental-keystone-url string                        If passed, activates the keystone authentication plugin.
      --external-hostname string                                The hostname to use when generating externalized URLs for this master (e.g. Swagger API Docs).
-      --feature-gates value                                     A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --feature-gates mapStringBool                             A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
 AllAlpha=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
 AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
-      --google-json-key string                                  The Google Cloud Platform Service Account JSON Key to use for authentication.
-      --insecure-bind-address value                             The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all interfaces). Defaults to localhost. (default 127.0.0.1)
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
+StreamingProxyRedirects=true|false (ALPHA - default=false)
+      --insecure-allow-any-token username/group1,group2         If set, your server will be INSECURE.  Any token will be allowed and user information will be parsed from the token as username/group1,group2
+      --insecure-bind-address ip                                The IP address on which to serve the --insecure-port (set to 0.0.0.0 for all interfaces). Defaults to localhost. (default 127.0.0.1)
      --insecure-port int                                       The port on which to serve unsecured, unauthenticated access. Default 8080. It is assumed that firewall rules are set up such that this port is not reachable from outside of the cluster and that port 443 on the cluster's public address is proxied to this port. This is performed by nginx in the default setup. (default 8080)
+      --ir-data-source string                                   Data source used by InitialResources. Supported options: influxdb, gcm. (default "influxdb")
+      --ir-dbname string                                        InfluxDB database name which contains metrics required by InitialResources. (default "k8s")
+      --ir-hawkular string                                      Hawkular configuration URL.
+      --ir-influxdb-host string                                 Address of InfluxDB which contains metrics required by InitialResources. (default "localhost:8080/api/v1/proxy/namespaces/kube-system/services/monitoring-influxdb:api")
+      --ir-namespace-only                                       Whether the estimation should be made only based on data from the same namespace.
+      --ir-password string                                      Password used for connecting to InfluxDB. (default "root")
+      --ir-percentile int                                       Which percentile of samples should InitialResources use when estimating resources. For experiment purposes. (default 90)
+      --ir-user string                                          User used for connecting to InfluxDB. (default "root")
      --kubelet-certificate-authority string                    Path to a cert file for the certificate authority.
      --kubelet-client-certificate string                       Path to a client cert file for TLS.
      --kubelet-client-key string                               Path to a client key file for TLS.
      --kubelet-https                                           Use https for kubelet connections. (default true)
+      --kubelet-preferred-address-types stringSlice             List of the preferred NodeAddressTypes to use for kubelet connections. (default [Hostname,InternalIP,ExternalIP,LegacyHostIP])
      --kubelet-timeout duration                                Timeout for kubelet operations. (default 5s)
      --kubernetes-service-node-port int                        If non-zero, the Kubernetes master service (which apiserver creates/maintains) will be of type NodePort, using this as the value of the port. If zero, the Kubernetes master service will be of type ClusterIP.
      --long-running-request-regexp string                      A regular expression matching long running requests which should be excluded from maximum inflight request handling. (default "(/|^)((watch|proxy)(/|$)|(logs?|portforward|exec|attach)/?$)")
-      --master-service-namespace string                         The namespace from which the kubernetes master services should be injected into pods. (default "default")
+      --master-service-namespace string                         DEPRECATED: the namespace from which the kubernetes master services should be injected into pods. (default "default")
      --max-connection-bytes-per-sec int                        If non-zero, throttle each user connection to this number of bytes/sec. Currently only applies to long-running requests.
      --max-requests-inflight int                               The maximum number of requests in flight at a given time. When the server exceeds this, it rejects requests. Zero for no limit. (default 400)
      --min-request-timeout int                                 An optional field indicating the minimum number of seconds a handler must keep a request open before timing it out. Currently only honored by the watch request handler, which picks a randomized value above this number as the connection timeout, to spread out load. (default 1800)
      --oidc-ca-file string                                     If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file, otherwise the host's root CA set will be used.
      --oidc-client-id string                                   The client ID for the OpenID Connect client, must be set if oidc-issuer-url is set.
-      --oidc-groups-claim string                                If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be an array of strings. This flag is experimental, please see the authentication documentation for further details.
+      --oidc-groups-claim string                                If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be a string or array of strings. This flag is experimental, please see the authentication documentation for further details.
      --oidc-issuer-url string                                  The URL of the OpenID issuer, only HTTPS scheme will be accepted. If set, it will be used to verify the OIDC JSON Web Token (JWT).
      --oidc-username-claim string                              The OpenID claim to use as the user name. Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. This flag is experimental, please see the authentication documentation for further details. (default "sub")
      --profiling                                               Enable profiling via web interface host:port/debug/pprof/ (default true)
      --repair-malformed-updates                                If true, server will do its best to fix the update request to pass the validation, e.g., setting empty UID in update request to its existing value. This flag can be turned off after we fix all the clients that send malformed updates. (default true)
-      --runtime-config value                                    A set of key=value pairs that describe runtime configuration that may be passed to apiserver. apis/<groupVersion> key can be used to turn on/off specific api versions. apis/<groupVersion>/<resource> can be used to turn on/off specific resources. api/all and api/legacy are special keys to control all and legacy api versions respectively.
+      --requestheader-allowed-names stringSlice                 List of client certificate common names to allow to provide usernames in headers specified by --requestheader-username-headers. If empty, any client certificate validated by the authorities in --requestheader-client-ca-file is allowed.
+      --requestheader-client-ca-file string                     Root certificate bundle to use to verify client certificates on incoming requests before trusting usernames in headers specified by --requestheader-username-headers
+      --requestheader-username-headers stringSlice              List of request headers to inspect for usernames. X-Remote-User is common.
+      --runtime-config mapStringString                          A set of key=value pairs that describe runtime configuration that may be passed to apiserver. apis/<groupVersion> key can be used to turn on/off specific api versions. apis/<groupVersion>/<resource> can be used to turn on/off specific resources. api/all and api/legacy are special keys to control all and legacy api versions respectively.
      --secure-port int                                         The port on which to serve HTTPS with authentication and authorization. If 0, don't serve HTTPS at all. (default 6443)
-      --service-account-key-file string                         File containing PEM-encoded x509 RSA private or public key, used to verify ServiceAccount tokens. If unspecified, --tls-private-key-file is used.
+      --service-account-key-file stringArray                    File containing PEM-encoded x509 RSA or ECDSA private or public keys, used to verify ServiceAccount tokens. If unspecified, --tls-private-key-file is used. The specified file can contain multiple keys, and the flag can be specified multiple times with different files.
      --service-account-lookup                                  If true, validate ServiceAccount tokens exist in etcd as part of authentication.
-      --service-cluster-ip-range value                          A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes for pods.
-      --service-node-port-range value                           A port range to reserve for services with NodePort visibility. Example: '30000-32767'. Inclusive at both ends of the range. (default 30000-32767)
+      --service-cluster-ip-range ipNet                          A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes for pods.
+      --service-node-port-range portRange                       A port range to reserve for services with NodePort visibility. Example: '30000-32767'. Inclusive at both ends of the range. (default 30000-32767)
      --ssh-keyfile string                                      If non-empty, use secure SSH proxy to the nodes, using this user keyfile
      --ssh-user string                                         If non-empty, use secure SSH proxy to the nodes, using this user name
      --storage-backend string                                  The storage backend for persistence. Options: 'etcd2' (default), 'etcd3'.
      --storage-media-type string                               The media type to use to store objects in storage. Defaults to application/json. Some resources may only support a specific media type and will ignore this setting. (default "application/json")
-      --storage-versions string                                 The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1alpha1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,imagepolicy.k8s.io/v1alpha1,policy/v1alpha1,rbac.authorization.k8s.io/v1alpha1,v1")
+      --storage-versions string                                 The per-group version to store resources in. Specified in the format "group1/version1,group2/version2,...". In the case where objects are moved from one group to the other, you may specify the format "group1=group2/v1beta1,group3/v1beta1,...". You only need to pass the groups you wish to change from the defaults. It defaults to a list of preferred versions of all registered groups, which is derived from the KUBE_API_VERSIONS environment variable. (default "apps/v1beta1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1beta1,autoscaling/v1,batch/v1,certificates.k8s.io/v1alpha1,componentconfig/v1alpha1,extensions/v1beta1,imagepolicy.k8s.io/v1alpha1,policy/v1beta1,rbac.authorization.k8s.io/v1alpha1,storage.k8s.io/v1beta1,v1")
      --target-ram-mb int                                       Memory limit for apiserver in MB (used to configure sizes of caches, etc.)
-      --tls-cert-file string                                    File containing x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.
-      --tls-private-key-file string                             File containing x509 private key matching --tls-cert-file.
+      --tls-ca-file string                                      If set, this certificate authority will used for secure access from Admission Controllers. This must be a valid PEM-encoded CA bundle.
+      --tls-cert-file string                                    File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.
+      --tls-private-key-file string                             File containing the default x509 private key matching --tls-cert-file.
+      --tls-sni-cert-key namedCertKey                           A pair of x509 certificate and private key file paths, optionally suffixed with a list of domain patterns which are fully qualified domain names, possibly with prefixed wildcard segments. If no domain patterns are provided, the names of the certificate are extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns trump over extracted names. For multiple key/certificate pairs, use the --tls-sni-cert-key multiple times. Examples: "example.key,example.crt" or "*.foo.com,foo.com:foo.key,foo.crt". (default [])
      --token-auth-file string                                  If set, the file that will be used to secure the secure port of the API server via token authentication.
      --watch-cache                                             Enable watch caching in the apiserver (default true)
-      --watch-cache-sizes value                                 List of watch cache sizes for every resource (pods, nodes, etc.), comma separated. The individual override format: resource#size, where size is a number. It takes effect when watch-cache is enabled. (default [])
+      --watch-cache-sizes stringSlice                           List of watch cache sizes for every resource (pods, nodes, etc.), comma separated. The individual override format: resource#size, where size is a number. It takes effect when watch-cache is enabled.
 ```

-###### Auto generated by spf13/cobra on 2-Sep-2016
-
-
-
-
+###### Auto generated by spf13/cobra on 13-Dec-2016


 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
@@ -1,4 +1,6 @@
 ---
+title: kube-controller-manager
+notitle: true
 ---

 ## kube-controller-manager
@@ -24,45 +26,47 @@ kube-controller-manager
 ### Options

 ```
-      --address value                                                     The IP address to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
+      --address ip                                                        The IP address to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
      --allocate-node-cidrs                                               Should CIDRs for Pods be allocated and set on the cloud provider.
+      --allow-verification-with-non-compliant-keys                        Allow a SignatureVerifier to use keys which are technically non-compliant with RFC6962.
      --cloud-config string                                               The path to the cloud provider configuration file.  Empty string for no configuration file.
      --cloud-provider string                                             The provider for cloud services.  Empty string for no provider.
      --cluster-cidr string                                               CIDR Range for Pods in cluster.
      --cluster-name string                                               The instance prefix for the cluster (default "kubernetes")
      --cluster-signing-cert-file string                                  Filename containing a PEM-encoded X509 CA certificate used to issue cluster-scoped certificates (default "/etc/kubernetes/ca/ca.pem")
      --cluster-signing-key-file string                                   Filename containing a PEM-encoded RSA or ECDSA private key used to sign cluster-scoped certificates (default "/etc/kubernetes/ca/ca.key")
-      --concurrent-deployment-syncs value                                 The number of deployment objects that are allowed to sync concurrently. Larger number = more responsive deployments, but more CPU (and network) load (default 5)
-      --concurrent-endpoint-syncs value                                   The number of endpoint syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load (default 5)
-      --concurrent-gc-syncs value                                         The number of garbage collector workers that are allowed to sync concurrently. (default 20)
-      --concurrent-namespace-syncs value                                  The number of namespace objects that are allowed to sync concurrently. Larger number = more responsive namespace termination, but more CPU (and network) load (default 2)
-      --concurrent-replicaset-syncs value                                 The number of replica sets that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load (default 5)
-      --concurrent-resource-quota-syncs value                             The number of resource quotas that are allowed to sync concurrently. Larger number = more responsive quota management, but more CPU (and network) load (default 5)
-      --concurrent-service-syncs value                                    The number of services that are allowed to sync concurrently. Larger number = more responsive service management, but more CPU (and network) load (default 1)
-      --concurrent-serviceaccount-token-syncs value                       The number of service account token objects that are allowed to sync concurrently. Larger number = more responsive token generation, but more CPU (and network) load (default 5)
-      --concurrent_rc_syncs value                                         The number of replication controllers that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load (default 5)
+      --concurrent-deployment-syncs int32                                 The number of deployment objects that are allowed to sync concurrently. Larger number = more responsive deployments, but more CPU (and network) load (default 5)
+      --concurrent-endpoint-syncs int32                                   The number of endpoint syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load (default 5)
+      --concurrent-gc-syncs int32                                         The number of garbage collector workers that are allowed to sync concurrently. (default 20)
+      --concurrent-namespace-syncs int32                                  The number of namespace objects that are allowed to sync concurrently. Larger number = more responsive namespace termination, but more CPU (and network) load (default 2)
+      --concurrent-replicaset-syncs int32                                 The number of replica sets that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load (default 5)
+      --concurrent-resource-quota-syncs int32                             The number of resource quotas that are allowed to sync concurrently. Larger number = more responsive quota management, but more CPU (and network) load (default 5)
+      --concurrent-service-syncs int32                                    The number of services that are allowed to sync concurrently. Larger number = more responsive service management, but more CPU (and network) load (default 1)
+      --concurrent-serviceaccount-token-syncs int32                       The number of service account token objects that are allowed to sync concurrently. Larger number = more responsive token generation, but more CPU (and network) load (default 5)
+      --concurrent_rc_syncs int32                                         The number of replication controllers that are allowed to sync concurrently. Larger number = more responsive replica management, but more CPU (and network) load (default 5)
      --configure-cloud-routes                                            Should CIDRs allocated by allocate-node-cidrs be configured on the cloud provider. (default true)
      --controller-start-interval duration                                Interval between starting controller managers.
-      --daemonset-lookup-cache-size value                                 The the size of lookup cache for daemonsets. Larger number = more responsive daemonsets, but more MEM load. (default 1024)
+      --daemonset-lookup-cache-size int32                                 The size of lookup cache for daemonsets. Larger number = more responsive daemonsets, but more MEM load. (default 1024)
      --deployment-controller-sync-period duration                        Period for syncing the deployments. (default 30s)
      --enable-dynamic-provisioning                                       Enable dynamic provisioning for environments that support it. (default true)
      --enable-garbage-collector                                          Enables the generic garbage collector. MUST be synced with the corresponding flag of the kube-apiserver. (default true)
      --enable-hostpath-provisioner                                       Enable HostPath PV provisioning when running without a cloud provider. This allows testing and development of provisioning features.  HostPath provisioning is not supported in any way, won't work in a multi-node cluster, and should not be used for anything other than testing or development.
-      --feature-gates value                                               A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --feature-gates mapStringBool                                       A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
 AllAlpha=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
 AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
+StreamingProxyRedirects=true|false (ALPHA - default=false)
      --flex-volume-plugin-dir string                                     Full path of the directory in which the flex volume plugin should search for additional third party volume plugins. (default "/usr/libexec/kubernetes/kubelet-plugins/volume/exec/")
-      --google-json-key string                                            The Google Cloud Platform Service Account JSON Key to use for authentication.
      --horizontal-pod-autoscaler-sync-period duration                    The period for syncing the number of pods in horizontal pod autoscaler. (default 30s)
      --insecure-experimental-approve-all-kubelet-csrs-for-group string   The group for which the controller-manager will auto approve all CSRs for kubelet client certificates.
-      --kube-api-burst value                                              Burst to use while talking with kubernetes apiserver (default 30)
+      --kube-api-burst int32                                              Burst to use while talking with Kubernetes apiserver (default 30)
      --kube-api-content-type string                                      Content type of requests sent to apiserver. (default "application/vnd.kubernetes.protobuf")
-      --kube-api-qps value                                                QPS to use while talking with kubernetes apiserver (default 20)
+      --kube-api-qps float32                                              QPS to use while talking with Kubernetes apiserver (default 20)
      --kubeconfig string                                                 Path to kubeconfig file with authorization and master location information.
-      --large-cluster-size-threshold value                                Number of nodes from which NodeController treats the cluster as large for the eviction logic purposes. --secondary-node-eviction-rate is implicitly overridden to 0 for clusters this size or smaller. (default 50)
+      --large-cluster-size-threshold int32                                Number of nodes from which NodeController treats the cluster as large for the eviction logic purposes. --secondary-node-eviction-rate is implicitly overridden to 0 for clusters this size or smaller. (default 50)
      --leader-elect                                                      Start a leader election client and gain leadership before executing the main loop. Enable this when running replicated components for high availability. (default true)
      --leader-elect-lease-duration duration                              The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled. (default 15s)
      --leader-elect-renew-deadline duration                              The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled. (default 10s)
@@ -70,39 +74,36 @@ DynamicVolumeProvisioning=true|false (ALPHA - default=true)
      --master string                                                     The address of the Kubernetes API server (overrides any value in kubeconfig)
      --min-resync-period duration                                        The resync period in reflectors will be random between MinResyncPeriod and 2*MinResyncPeriod (default 12h0m0s)
      --namespace-sync-period duration                                    The period for syncing namespace life-cycle updates (default 5m0s)
-      --node-cidr-mask-size value                                         Mask size for node cidr in cluster. (default 24)
-      --node-eviction-rate value                                          Number of nodes per second on which pods are deleted in case of node failure when a zone is healthy (see --unhealthy-zone-threshold for definition of healthy/unhealthy). Zone refers to entire cluster in non-multizone clusters. (default 0.1)
+      --node-cidr-mask-size int32                                         Mask size for node cidr in cluster. (default 24)
+      --node-eviction-rate float32                                        Number of nodes per second on which pods are deleted in case of node failure when a zone is healthy (see --unhealthy-zone-threshold for definition of healthy/unhealthy). Zone refers to entire cluster in non-multizone clusters. (default 0.1)
      --node-monitor-grace-period duration                                Amount of time which we allow running Node to be unresponsive before marking it unhealthy. Must be N times more than kubelet's nodeStatusUpdateFrequency, where N means number of retries allowed for kubelet to post node status. (default 40s)
      --node-monitor-period duration                                      The period for syncing NodeStatus in NodeController. (default 5s)
      --node-startup-grace-period duration                                Amount of time which we allow starting Node to be unresponsive before marking it unhealthy. (default 1m0s)
-      --node-sync-period duration                                         The period for syncing nodes from cloudprovider. Longer periods will result in fewer calls to cloud provider, but may delay addition of new nodes to cluster. (default 10s)
      --pod-eviction-timeout duration                                     The grace period for deleting pods on failed nodes. (default 5m0s)
-      --port value                                                        The port that the controller-manager's http service runs on (default 10252)
+      --port int32                                                        The port that the controller-manager's http service runs on (default 10252)
      --profiling                                                         Enable profiling via web interface host:port/debug/pprof/ (default true)
-      --pv-recycler-increment-timeout-nfs value                           the increment of time added per Gi to ActiveDeadlineSeconds for an NFS scrubber pod (default 30)
-      --pv-recycler-minimum-timeout-hostpath value                        The minimum ActiveDeadlineSeconds to use for a HostPath Recycler pod.  This is for development and testing only and will not work in a multi-node cluster. (default 60)
-      --pv-recycler-minimum-timeout-nfs value                             The minimum ActiveDeadlineSeconds to use for an NFS Recycler pod (default 300)
+      --pv-recycler-increment-timeout-nfs int32                           the increment of time added per Gi to ActiveDeadlineSeconds for an NFS scrubber pod (default 30)
+      --pv-recycler-minimum-timeout-hostpath int32                        The minimum ActiveDeadlineSeconds to use for a HostPath Recycler pod.  This is for development and testing only and will not work in a multi-node cluster. (default 60)
+      --pv-recycler-minimum-timeout-nfs int32                             The minimum ActiveDeadlineSeconds to use for an NFS Recycler pod (default 300)
      --pv-recycler-pod-template-filepath-hostpath string                 The file path to a pod definition used as a template for HostPath persistent volume recycling. This is for development and testing only and will not work in a multi-node cluster.
      --pv-recycler-pod-template-filepath-nfs string                      The file path to a pod definition used as a template for NFS persistent volume recycling
-      --pv-recycler-timeout-increment-hostpath value                      the increment of time added per Gi to ActiveDeadlineSeconds for a HostPath scrubber pod.  This is for development and testing only and will not work in a multi-node cluster. (default 30)
+      --pv-recycler-timeout-increment-hostpath int32                      the increment of time added per Gi to ActiveDeadlineSeconds for a HostPath scrubber pod.  This is for development and testing only and will not work in a multi-node cluster. (default 30)
      --pvclaimbinder-sync-period duration                                The period for syncing persistent volumes and persistent volume claims (default 15s)
-      --replicaset-lookup-cache-size value                                The the size of lookup cache for replicatsets. Larger number = more responsive replica management, but more MEM load. (default 4096)
-      --replication-controller-lookup-cache-size value                    The the size of lookup cache for replication controllers. Larger number = more responsive replica management, but more MEM load. (default 4096)
+      --replicaset-lookup-cache-size int32                                The size of lookup cache for replicatsets. Larger number = more responsive replica management, but more MEM load. (default 4096)
+      --replication-controller-lookup-cache-size int32                    The size of lookup cache for replication controllers. Larger number = more responsive replica management, but more MEM load. (default 4096)
      --resource-quota-sync-period duration                               The period for syncing quota usage status in the system (default 5m0s)
      --root-ca-file string                                               If set, this root certificate authority will be included in service account's token secret. This must be a valid PEM-encoded CA bundle.
-      --secondary-node-eviction-rate value                                Number of nodes per second on which pods are deleted in case of node failure when a zone is unhealthy (see --unhealthy-zone-threshold for definition of healthy/unhealthy). Zone refers to entire cluster in non-multizone clusters. This value is implicitly overridden to 0 if the cluster size is smaller than --large-cluster-size-threshold. (default 0.01)
-      --service-account-private-key-file string                           Filename containing a PEM-encoded private RSA key used to sign service account tokens.
+      --route-reconciliation-period duration                              The period for reconciling routes created for Nodes by cloud provider. (default 10s)
+      --secondary-node-eviction-rate float32                              Number of nodes per second on which pods are deleted in case of node failure when a zone is unhealthy (see --unhealthy-zone-threshold for definition of healthy/unhealthy). Zone refers to entire cluster in non-multizone clusters. This value is implicitly overridden to 0 if the cluster size is smaller than --large-cluster-size-threshold. (default 0.01)
+      --service-account-private-key-file string                           Filename containing a PEM-encoded private RSA or ECDSA key used to sign service account tokens.
      --service-cluster-ip-range string                                   CIDR Range for Services in cluster.
      --service-sync-period duration                                      The period for syncing services with their external load balancers (default 5m0s)
-      --terminated-pod-gc-threshold value                                 Number of terminated pods that can exist before the terminated pod garbage collector starts deleting terminated pods. If <= 0, the terminated pod garbage collector is disabled. (default 12500)
-      --unhealthy-zone-threshold value                                    Fraction of Nodes in a zone which needs to be not Ready (minimum 3) for zone to be treated as unhealthy.  (default 0.55)
+      --terminated-pod-gc-threshold int32                                 Number of terminated pods that can exist before the terminated pod garbage collector starts deleting terminated pods. If <= 0, the terminated pod garbage collector is disabled. (default 12500)
+      --unhealthy-zone-threshold float32                                  Fraction of Nodes in a zone which needs to be not Ready (minimum 3) for zone to be treated as unhealthy.  (default 0.55)
+      --use-service-account-credentials                                   If true, use individual service account credentials for each controller.
 ```

-###### Auto generated by spf13/cobra on 2-Sep-2016
-
-
-
-
+###### Auto generated by spf13/cobra on 13-Dec-2016


 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
@@ -1,4 +1,6 @@
 ---
+title: kube-proxy
+notitle: true
 ---

 ## kube-proxy
@@ -23,42 +25,41 @@ kube-proxy
 ### Options

 ```
-      --bind-address value                           The IP address for the proxy server to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
+      --bind-address ip                              The IP address for the proxy server to serve on (set to 0.0.0.0 for all interfaces) (default 0.0.0.0)
      --cleanup-iptables                             If true cleanup iptables rules and exit.
      --cluster-cidr string                          The CIDR range of pods in the cluster. It is used to bridge traffic coming from outside of the cluster. If not provided, no off-cluster bridging will be performed.
      --config-sync-period duration                  How often configuration from the apiserver is refreshed.  Must be greater than 0. (default 15m0s)
-      --conntrack-max value                          Maximum number of NAT connections to track (0 to leave as-is).
-      --conntrack-max-per-core value                 Maximum number of NAT connections to track per CPU core (0 to leave as-is). This is only considered if conntrack-max is 0. (default 32768)
+      --conntrack-max-per-core int32                 Maximum number of NAT connections to track per CPU core (0 to leave the limit as-is and ignore conntrack-min). (default 32768)
+      --conntrack-min int32                          Minimum number of conntrack entries to allocate, regardless of conntrack-max-per-core (set conntrack-max-per-core=0 to leave the limit as-is). (default 131072)
+      --conntrack-tcp-timeout-close-wait duration    NAT timeout for TCP connections in the CLOSE_WAIT state (default 1h0m0s)
      --conntrack-tcp-timeout-established duration   Idle timeout for established TCP connections (0 to leave as-is) (default 24h0m0s)
-      --feature-gates value                          A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --feature-gates mapStringBool                  A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
 AllAlpha=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
 AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
-      --google-json-key string                       The Google Cloud Platform Service Account JSON Key to use for authentication.
-      --healthz-bind-address value                   The IP address for the health check server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) (default 127.0.0.1)
-      --healthz-port value                           The port to bind the health check server. Use 0 to disable. (default 10249)
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
+StreamingProxyRedirects=true|false (ALPHA - default=false)
+      --healthz-bind-address ip                      The IP address for the health check server to serve on, defaulting to 127.0.0.1 (set to 0.0.0.0 for all interfaces) (default 127.0.0.1)
+      --healthz-port int32                           The port to bind the health check server. Use 0 to disable. (default 10249)
      --hostname-override string                     If non-empty, will use this string as identification instead of the actual hostname.
-      --iptables-masquerade-bit value                If using the pure iptables proxy, the bit of the fwmark space to mark packets requiring SNAT with.  Must be within the range [0, 31]. (default 14)
-      --iptables-sync-period duration                How often iptables rules are refreshed (e.g. '5s', '1m', '2h22m').  Must be greater than 0. (default 30s)
-      --kube-api-burst value                         Burst to use while talking with kubernetes apiserver (default 10)
+      --iptables-masquerade-bit int32                If using the pure iptables proxy, the bit of the fwmark space to mark packets requiring SNAT with.  Must be within the range [0, 31]. (default 14)
+      --iptables-min-sync-period duration            The minimum interval of how often the iptables rules can be refreshed as endpoints and services change (e.g. '5s', '1m', '2h22m').
+      --iptables-sync-period duration                The maximum interval of how often iptables rules are refreshed (e.g. '5s', '1m', '2h22m').  Must be greater than 0. (default 30s)
+      --kube-api-burst int32                         Burst to use while talking with Kubernetes apiserver (default 10)
      --kube-api-content-type string                 Content type of requests sent to apiserver. (default "application/vnd.kubernetes.protobuf")
-      --kube-api-qps value                           QPS to use while talking with kubernetes apiserver (default 5)
+      --kube-api-qps float32                         QPS to use while talking with Kubernetes apiserver (default 5)
      --kubeconfig string                            Path to kubeconfig file with authorization information (the master location is set by the master flag).
      --masquerade-all                               If using the pure iptables proxy, SNAT everything
      --master string                                The address of the Kubernetes API server (overrides any value in kubeconfig)
-      --oom-score-adj value                          The oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000] (default -999)
-      --proxy-mode value                             Which proxy mode to use: 'userspace' (older) or 'iptables' (faster). If blank, look at the Node object on the Kubernetes API and respect the 'net.experimental.kubernetes.io/proxy-mode' annotation if provided.  Otherwise use the best-available proxy (currently iptables).  If the iptables proxy is selected, regardless of how, but the system's kernel or iptables versions are insufficient, this always falls back to the userspace proxy.
-      --proxy-port-range value                       Range of host ports (beginPort-endPort, inclusive) that may be consumed in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.
+      --oom-score-adj int32                          The oom-score-adj value for kube-proxy process. Values must be within the range [-1000, 1000] (default -999)
+      --proxy-mode ProxyMode                         Which proxy mode to use: 'userspace' (older) or 'iptables' (faster). If blank, look at the Node object on the Kubernetes API and respect the 'net.experimental.kubernetes.io/proxy-mode' annotation if provided.  Otherwise use the best-available proxy (currently iptables).  If the iptables proxy is selected, regardless of how, but the system's kernel or iptables versions are insufficient, this always falls back to the userspace proxy.
+      --proxy-port-range port-range                  Range of host ports (beginPort-endPort, inclusive) that may be consumed in order to proxy service traffic. If unspecified (0-0) then ports will be randomly chosen.
      --udp-timeout duration                         How long an idle UDP connection will be kept open (e.g. '250ms', '2s').  Must be greater than 0. Only applicable for proxy-mode=userspace (default 250ms)
 ```

-###### Auto generated by spf13/cobra on 2-Sep-2016
-
-
-
-
+###### Auto generated by spf13/cobra on 13-Dec-2016


 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
@@ -1,4 +1,6 @@
 ---
+title: kube-scheduler
+notitle: true
 ---

 ## kube-scheduler
@@ -24,19 +26,20 @@ kube-scheduler

 ```
      --address string                           The IP address to serve on (set to 0.0.0.0 for all interfaces) (default "0.0.0.0")
-      --algorithm-provider string                The scheduling algorithm provider to use, one of: DefaultProvider | ClusterAutoscalerProvider (default "DefaultProvider")
+      --algorithm-provider string                The scheduling algorithm provider to use, one of: ClusterAutoscalerProvider | DefaultProvider (default "DefaultProvider")
      --failure-domains string                   Indicate the "all topologies" set for an empty topologyKey when it's used for PreferredDuringScheduling pod anti-affinity. (default "kubernetes.io/hostname,failure-domain.beta.kubernetes.io/zone,failure-domain.beta.kubernetes.io/region")
-      --feature-gates value                      A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+      --feature-gates mapStringBool              A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
+AllAlpha=true|false (ALPHA - default=false)
+AllowExtTrafficLocalEndpoints=true|false (BETA - default=true)
+AppArmor=true|false (BETA - default=true)
 DynamicKubeletConfig=true|false (ALPHA - default=false)
 DynamicVolumeProvisioning=true|false (ALPHA - default=true)
-AllAlpha=true|false (ALPHA - default=false)
-AllowExtTrafficLocalEndpoints=true|false (ALPHA - default=false)
-AppArmor=true|false (BETA - default=true)
-      --google-json-key string                   The Google Cloud Platform Service Account JSON Key to use for authentication.
+ExperimentalHostUserNamespaceDefaulting=true|false (ALPHA - default=false)
+StreamingProxyRedirects=true|false (ALPHA - default=false)
      --hard-pod-affinity-symmetric-weight int   RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule corresponding to every RequiredDuringScheduling affinity rule. --hard-pod-affinity-symmetric-weight represents the weight of implicit PreferredDuringScheduling affinity rule. (default 1)
-      --kube-api-burst value                     Burst to use while talking with kubernetes apiserver (default 100)
+      --kube-api-burst int32                     Burst to use while talking with Kubernetes apiserver (default 100)
      --kube-api-content-type string             Content type of requests sent to apiserver. (default "application/vnd.kubernetes.protobuf")
-      --kube-api-qps value                       QPS to use while talking with kubernetes apiserver (default 50)
+      --kube-api-qps float32                     QPS to use while talking with Kubernetes apiserver (default 50)
      --kubeconfig string                        Path to kubeconfig file with authorization and master location information.
      --leader-elect                             Start a leader election client and gain leadership before executing the main loop. Enable this when running replicated components for high availability. (default true)
      --leader-elect-lease-duration duration     The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled. (default 15s)
@@ -44,16 +47,12 @@ AppArmor=true|false (BETA - default=true)
      --leader-elect-retry-period duration       The duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled. (default 2s)
      --master string                            The address of the Kubernetes API server (overrides any value in kubeconfig)
      --policy-config-file string                File with scheduler policy configuration
-      --port value                               The port that the scheduler's http service runs on (default 10251)
+      --port int32                               The port that the scheduler's http service runs on (default 10251)
      --profiling                                Enable profiling via web interface host:port/debug/pprof/ (default true)
      --scheduler-name string                    Name of the scheduler, used to select which pods will be processed by this scheduler, based on pod's annotation with key 'scheduler.alpha.kubernetes.io/name' (default "default-scheduler")
 ```

-###### Auto generated by spf13/cobra on 2-Sep-2016
-
-
-
-
+###### Auto generated by spf13/cobra on 13-Dec-2016


 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
@@ -0,0 +1,283 @@
+---
+assignees:
+- mikedanese
+- luxas
+- errordeveloper
+- jbeda
+title: kubeadm reference
+---
+
+This document provides information on how to use kubeadm's advanced options.
+
+Running `kubeadm init` bootstraps a Kubernetes cluster. This consists of the
+following steps:
+
+1. kubeadm runs a series of pre-flight checks to validate the system state
+before making changes. Some checks only trigger warnings, others are
+considered errors and will exit kubeadm until the problem is corrected or
+the user specifies `--skip-preflight-checks`.
+
+1. kubeadm generates a token that additional nodes can use to register
+themselves with the master in future.  Optionally, the user can provide a token.
+
+1. kubeadm generates a self-signed CA using openssl to provision identities
+for each node in the cluster, and for the API server to secure communication
+with clients.
+
+1. Outputting a kubeconfig file for the kubelet to use to connect to the API
+server, as well as an additional kubeconfig file for administration.
+
+1. kubeadm generates Kubernetes resource manifests for the API server,
+controller manager and scheduler, and placing them in
+`/etc/kubernetes/manifests`. The kubelet watches this directory for static
+resources to create on startup. These are the core components of Kubernetes, and
+once they are up and running we can use `kubectl` to set up or manage any
+additional components.
+
+1. kubeadm installs some add-on components, such as DNS or discovery, via the API
+server.
+
+Running `kubeadm join` on each node in the cluster consists of the following steps:
+
+1. Use the token to talk to the API server and securely get the root CA
+certificate.
+
+1. Creates a local key pair.  Prepares a certificate signing request (CSR) and
+sends that off to the API server for signing.
+
+1. Configures the local kubelet to connect to the API server
+
+## Usage
+
+Fields that support multiple values do so either with comma separation, or by specifying
+the flag multiple times.
+
+### `kubeadm init`
+
+It is usually sufficient to run `kubeadm init` without any flags,
+but in some cases you might like to override the default behaviour.
+Here we specify all the flags that can be used to customise the Kubernetes
+installation.
+
+- `--api-advertise-addresses` (multiple values are allowed)
+- `--api-external-dns-names` (multiple values are allowed)
+
+By default, `kubeadm init` automatically detects IP addresses and uses
+these to generate certificates for the API server. This uses the IP address
+of the default network interface. If you would like to access the API server
+through a different IP address, or through a hostname, you can override these
+defaults with `--api-advertise-addresses` and `--api-external-dns-names`.
+For example, to generate certificates that verify the API server at addresses
+`10.100.245.1` and `100.123.121.1`, you could use
+`--api-advertise-addresses=10.100.245.1,100.123.121.1`. To allow it to be accessed
+with a hostname, `--api-external-dns-names=kubernetes.example.com,kube.example.com`
+Specifying `--api-advertise-addresses` disables auto detection of IP addresses.
+
+- `--cloud-provider`
+
+Currently, `kubeadm init` does not provide autodetection of cloud provider.
+This means that load balancing and persistent volumes are not supported out
+of the box. You can specify a cloud provider using `--cloud-provider`.
+Valid values are the ones supported by `controller-manager`, namely `"aws"`,
+`"azure"`, `"cloudstack"`, `"gce"`, `"mesos"`, `"openstack"`, `"ovirt"`,
+`"rackspace"`, `"vsphere"`. In order to provide additional configuration for
+the cloud provider, you should create a `/etc/kubernetes/cloud-config`
+file manually, before running `kubeadm init`. `kubeadm` automatically
+picks those settings up and ensures other nodes are configured correctly.
+The exact format and content of the file `/etc/kubernetes/cloud-config` depends
+on the type you specified for `--cloud-provider`; see the appropriate documentation
+for your cloud provider for details.
+You must also set the `--cloud-provider` and `--cloud-config` parameters
+yourself by editing the `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf`
+file appropriately.
+
+- `--external-etcd-cafile` etcd certificate authority file
+- `--external-etcd-endpoints` (multiple values are allowed)
+- `--external-etcd-certfile` etcd client certificate file
+- `--external-etcd-keyfile` etcd client key file
+
+By default, `kubeadm` deploys a single node etcd cluster on the master
+to store Kubernetes state. This means that any failure on the master node
+requires you to rebuild your cluster from scratch. Currently `kubeadm init`
+does not support automatic deployment of a highly available etcd cluster.
+If you would like to use your own etcd cluster, you can override this
+behaviour with `--external-etcd-endpoints`. `kubeadm` supports etcd client
+authentication using the `--external-etcd-cafile`, `--external-etcd-certfile`
+and `--external-etcd-keyfile` flags.
+
+- `--pod-network-cidr`
+
+For certain networking solutions the Kubernetes master can also play a role in
+allocating network ranges (CIDRs) to each node. This includes many cloud providers
+and flannel. You can specify a subnet range that will be broken down and handed out
+to each node with the `--pod-network-cidr` flag. This should be a minimum of a /16 so
+controller-manager is able to assign /24 subnets to each node in the cluster.
+If you are using flannel with [this manifest](https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml)
+you should use `--pod-network-cidr=10.244.0.0/16`. Most CNI based networking solutions
+do not require this flag.
+
+- `--service-cidr` (default '10.96.0.0/12')
+
+You can use the `--service-cidr` flag to override the subnet Kubernetes uses to
+assign pods IP addresses. If you do, you will also need to update the
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` file to reflect this change
+else DNS will not function correctly.
+
+- `--service-dns-domain` (default 'cluster.local')
+
+By default, `kubeadm init` deploys a cluster that assigns services with DNS names
+`<service_name>.<namespace>.svc.cluster.local`. You can use the `--service-dns-domain`
+to change the DNS name suffix. Again, you will need to update the
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` file accordingly else DNS will
+not function correctly.
+
+- `--skip-preflight-checks`
+
+By default, `kubeadm` runs a series of preflight checks to validate the system
+before making any changes. Advanced users can use this flag to bypass these if
+necessary.
+
+- `--token`
+
+By default, `kubeadm init` automatically generates the token used to initialise
+each new node. If you would like to manually specify this token, you can use the
+`--token` flag. The token must be of the format `<6 character string>.<16 character string>`.
+
+- `--use-kubernetes-version` (default 'v1.5.1') the kubernetes version to initialise
+
+`kubeadm` was originally built for Kubernetes version **v1.4.0**, older versions are not
+supported. With this flag you can try any future version, e.g. **v1.6.0-beta.1**
+whenever it comes out (check [releases page](https://github.com/kubernetes/kubernetes/releases)
+for a full list of available versions).
+
+### `kubeadm join`
+
+When you use kubeadm join, you must supply the token used to secure cluster
+boostrap as a mandatory flag, and the master IP address as a mandatory argument.
+
+Here's an example on how to use it:
+
+`kubeadm join --token=the_secret_token 192.168.1.1`
+
+- `--skip-preflight-checks`
+
+By default, `kubeadm` runs a series of preflight checks to validate the system
+before making any changes. Advanced users can use this flag to bypass these if
+necessary.
+
+- `--token=<token>`
+
+By default, when `kubeadm init` runs, a token is generated and revealed in the output.
+That's the token you should use here.
+
+
+## Using kubeadm with a configuration file
+
+WARNING: kubeadm is in alpha and the configuration API syntax will likely change before GA.
+
+It's possible to configure kubeadm with a configuration file instead of command line flags, and some more advanced features may only be
+available as configuration file options.
+
+### Sample Master Configuration
+
+```yaml
+apiVersion: kubeadm.k8s.io/v1alpha1
+kind: MasterConfiguration
+api:
+  advertiseAddresses:
+  - <address1|string>
+  - <address2|string>
+  bindPort: <int>
+  externalDNSNames:
+  - <dnsname1|string>
+  - <dnsname2|string>
+authorizationMode: <string>
+cloudProvider: <string>
+discovery:
+  bindPort: <int>
+etcd:
+  endpoints:
+  - <endpoint1|string>
+  - <endpoint2|string>
+  caFile: <path|string>
+  certFile: <path|string>
+  keyFile: <path|string>
+kubernetesVersion: <string>
+networking:
+  dnsDomain: <string>
+  serviceSubnet: <cidr>
+  podSubnet: <cidr>
+secrets:
+  givenToken: <token|string>
+```
+
+### Sample Node Configuration
+
+```yaml
+apiVersion: kubeadm.k8s.io/v1alpha1
+kind: NodeConfiguration
+apiPort: <int>
+discoveryPort: <int>
+masterAddresses:
+- <master1>
+secrets:
+  givenToken: <token|string>
+```
+
+## Automating kubeadm
+
+Rather than copying the token you obtained from `kubeadm init` to each node, as
+in the basic `kubeadm` tutorials, you can parallelize the token distribution for
+easier automation. To implement this automation, you must know the IP address
+that the master will have after it is started.
+
+1.  Generate a token.  This token must have the form  `<6 character string>.<16 character string>`.
+
+    Kubeadm can pre-generate a token for you:
+
+    ```console
+    $ kubeadm token generate
+    ```
+
+1. Start both the master node and the worker nodes concurrently with this token.  As they come up they should find each other and form the cluster.
+
+Once the cluster is up, you can grab the admin credentials from the master node at `/etc/kubernetes/admin.conf` and use that to talk to the cluster.
+
+## Environment variables
+
+There are some environment variables that modify the way that `kubeadm` works.  Most users will have no need to set these.
+These environment variables are a short-term solution, eventually they will be integrated in the kubeadm configuration file.
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| `KUBE_KUBERNETES_DIR` | `/etc/kubernetes` | Where most configuration files are written to and read from |
+| `KUBE_HOST_PKI_PATH` | `/etc/kubernetes/pki` | Directory for master PKI assets |
+| `KUBE_HOST_ETCD_PATH` | `/var/lib/etcd` | Local etcd state for Kubernetes cluster |
+| `KUBE_HYPERKUBE_IMAGE` | `` | If set, use a single hyperkube image with this name. If not set, individual images per server component will be used. |
+| `KUBE_DISCOVERY_IMAGE` | `gcr.io/google_containers/kube-discovery-<arch>:1.0` | The bootstrap discovery helper image to use. |
+| `KUBE_ETCD_IMAGE` | `gcr.io/google_containers/etcd-<arch>:2.2.5` | The etcd container image to use. |
+| `KUBE_REPO_PREFIX` | `gcr.io/google_containers` | The image prefix for all images that are used. |
+
+If you want to use kubeadm with an http proxy, you may need to configure it to support http_proxy, https_proxy, or no_proxy.
+
+For example, if your kube master node IP address is 10.18.17.16 and you have proxy support both http/https on 10.18.17.16 port 8080, you can use the following command:
+
+You can using following command 
+
+```bash
+export PROXY_PORT=8080
+export PROXY_IP=10.18.17.16
+export http_proxy=http://$PROXY_IP:$PROXY_PORT
+export HTTP_PROXY=$http_proxy
+export https_proxy=$http_proxy
+export HTTPS_PROXY=$http_proxy
+export no_proxy="localhost,127.0.0.1,localaddress,.localdomain.com,example.com,10.18.17.16"
+```
+
+Remember to change ```proxy_ip``` and add a kube master node IP address to ```no_proxy```.
+
+## Releases and release notes
+
+If you already have kubeadm installed and want to upgrade, run `apt-get update && apt-get upgrade` or `yum update` to get the latest version of kubeadm.
+
+Refer to the [CHANGELOG.md](https://github.com/kubernetes/kubeadm/blob/master/CHANGELOG.md) for more information.
@@ -0,0 +1,87 @@
+---
+assignees:
+- liggitt
+title: Kubelet authentication/authorization
+---
+
+* TOC
+{:toc}
+
+## Overview
+
+A kubelet's HTTPS endpoint exposes APIs which give access to data of varying sensitivity,
+and allow you to perform operations with varying levels of power on the node and within containers.
+
+This document describes how to authenticate and authorize access to the kubelet's HTTPS endpoint.
+
+## Kubelet authentication
+
+By default, requests to the kubelet's HTTPS endpoint that are not rejected by other configured
+authentication methods are treated as anonymous requests, and given a username of `system:anonymous`
+and a group of `system:unauthenticated`.
+
+To disable anonymous access and send `401 Unauthorized` responses to unauthenticated requests:
+
+* start the kubelet with the `--anonymous-auth=false` flag
+
+To enable X509 client certificate authentication to the kubelet's HTTPS endpoint:
+
+* start the kubelet with the `--client-ca-file` flag, providing a CA bundle to verify client certificates with
+* start the apiserver with `--kubelet-client-certificate` and `--kubelet-client-key` flags
+* see the [apiserver authentication documentation](/docs/admin/authentication/#x509-client-certs) for more details
+
+To enable API bearer tokens (including service account tokens) to be used to authenticate to the kubelet's HTTPS endpoint:
+
+* ensure the `authentication.k8s.io/v1beta1` API group is enabled in the API server
+* start the kubelet with the `--authentication-token-webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
+* the kubelet calls the `TokenReview` API on the configured API server to determine user information from bearer tokens
+
+## Kubelet authorization
+
+Any request that is successfully authenticated (including an anonymous request) is then authorized. The default authorization mode is `AlwaysAllow`, which allows all requests.
+
+There are many possible reasons to subdivide access to the kubelet API:
+
+* anonymous auth is enabled, but anonymous users' ability to call the kubelet API should be limited
+* bearer token auth is enabled, but arbitrary API users' (like service accounts) ability to call the kubelet API should be limited
+* client certificate auth is enabled, but only some of the client certificates signed by the configured CA should be allowed to use the kubelet API
+
+To subdivide access to the kubelet API, delegate authorization to the API server:
+
+* ensure the `authorization.k8s.io/v1beta1` API group is enabled in the API server
+* start the kubelet with the `--authorization-mode=Webhook`, `--kubeconfig`, and `--require-kubeconfig` flags
+* the kubelet calls the `SubjectAccessReview` API on the configured API server to determine whether each request is authorized
+
+The kubelet authorizes API requests using the same [request attributes](/docs/admin/authorization/#request-attributes) approach as the apiserver.
+
+The verb is determined from the incoming request's HTTP verb:
+
+HTTP verb | request verb
+----------|---------------
+POST      | create
+GET, HEAD | get
+PUT       | update
+PATCH     | patch
+DELETE    | delete
+
+The resource and subresource is determined from the incoming request's path:
+
+Kubelet API  | resource | subresource
+-------------|----------|------------
+/stats/\*     | nodes    | stats
+/metrics/\*   | nodes    | metrics
+/logs/\*      | nodes    | log
+/spec/\*      | nodes    | spec
+*all others* | nodes    | proxy
+
+The namespace and API group attributes are always an empty string, and
+the resource name is always the name of the kubelet's `Node` API object.
+
+When running in this mode, ensure the user identified by the `--kubelet-client-certificate` and `--kubelet-client-key`
+flags passed to the apiserver is authorized for the following attributes:
+
+* verb=\*, resource=nodes, subresource=proxy
+* verb=\*, resource=nodes, subresource=stats
+* verb=\*, resource=nodes, subresource=log
+* verb=\*, resource=nodes, subresource=spec
+* verb=\*, resource=nodes, subresource=metrics
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`*NOTE: This feature is beta in Kubernetes 1.5.*`