update kubelet flags

update kubernetes GitHub location
rename to Google Kubernetes Engine
2025-07-30 07:24:00 +03:00 · 2017-12-18 07:20:15 -08:00 · 2017-12-18 07:07:54 -08:00 · 2017-12-18 06:58:00 -08:00 · 2017-12-18 06:53:32 -08:00 · 2017-10-02 06:48:09 -07:00
13 changed files with 385 additions and 351 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,34 @@
+admin-csr.json             
+admin-key.pem              
+admin.csr                  
+admin.pem                  
+ca-config.json             
+ca-csr.json                
+ca-key.pem                 
+ca.csr                     
+ca.pem                     
+encryption-config.yaml     
+kube-proxy-csr.json        
+kube-proxy-key.pem         
+kube-proxy.csr             
+kube-proxy.kubeconfig      
+kube-proxy.pem             
+kubernetes-csr.json        
+kubernetes-key.pem         
+kubernetes.csr             
+kubernetes.pem             
+worker-0-csr.json          
+worker-0-key.pem
+worker-0.csr
+worker-0.kubeconfig
+worker-0.pem
+worker-1-csr.json
+worker-1-key.pem
+worker-1.csr
+worker-1.kubeconfig
+worker-1.pem
+worker-2-csr.json
+worker-2-key.pem
+worker-2.csr
+worker-2.kubeconfig
+worker-2.pem
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # Kubernetes The Hard Way

-This tutorial walks you through setting up Kubernetes the hard way. This guide is not for people looking for a fully automated command to bring up a Kubernetes cluster. If that's you then check out [Google Container Engine](https://cloud.google.com/container-engine), or the [Getting Started Guides](http://kubernetes.io/docs/getting-started-guides/).
+This tutorial walks you through setting up Kubernetes the hard way. This guide is not for people looking for a fully automated command to bring up a Kubernetes cluster. If that's you then check out [Google Kubernetes Engine](https://cloud.google.com/kubernetes-engine), or the [Getting Started Guides](http://kubernetes.io/docs/getting-started-guides/).

 Kubernetes The Hard Way is optimized for learning, which means taking the long route to ensure you understand each task required to bootstrap a Kubernetes cluster.

@@ -14,10 +14,10 @@ The target audience for this tutorial is someone planning to support a productio

 Kubernetes The Hard Way guides you through bootstrapping a highly available Kubernetes cluster with end-to-end encryption between components and RBAC authentication.

-* [Kubernetes](https://github.com/kubernetes/kubernetes) 1.7.4
-* [CRI-O Container Runtime](https://github.com/kubernetes-incubator/cri-o) v1.0.0-beta.0
-* [CNI Container Networking](https://github.com/containernetworking/cni) v0.6.0
-* [etcd](https://github.com/coreos/etcd) 3.2.6
+* [Kubernetes](https://github.com/kubernetes/kubernetes) 1.9.0
+* [cri-containerd Container Runtime](https://github.com/kubernetes-incubator/cri-containerd) 1.0.0-beta.0
+* [CNI Container Networking](https://github.com/containernetworking/cni) 0.6.0
+* [etcd](https://github.com/coreos/etcd) 3.2.11

 ## Labs

--- a/deployments/kube-dns.yaml
+++ b/deployments/kube-dns.yaml
@@ -1,8 +1,47 @@
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: kube-dns
+  namespace: kube-system
+  labels:
+    k8s-app: kube-dns
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+    kubernetes.io/name: "KubeDNS"
+spec:
+  selector:
+    k8s-app: kube-dns
+  clusterIP: 10.32.0.10
+  ports:
+  - name: dns
+    port: 53
+    protocol: UDP
+  - name: dns-tcp
+    port: 53
+    protocol: TCP
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: kube-dns
  namespace: kube-system
+  labels:
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -12,181 +51,156 @@ metadata:
  labels:
    addonmanager.kubernetes.io/mode: EnsureExists
 ---
-apiVersion: v1
-kind: Service
-metadata:
-  name: kube-dns
-  namespace: kube-system
-  labels:
-    k8s-app: kube-dns
-    kubernetes.io/cluster-service: "true"
-    kubernetes.io/name: "KubeDNS"
-spec:
-  clusterIP: 10.32.0.10
-  ports:
-    - name: dns
-      port: 53
-      protocol: UDP
-      targetPort: 53
-    - name: dns-tcp
-      port: 53
-      protocol: TCP
-      targetPort: 53
-  selector:
-    k8s-app: kube-dns
-  sessionAffinity: None
-  type: ClusterIP
---
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
+  name: kube-dns
+  namespace: kube-system
  labels:
    k8s-app: kube-dns
    kubernetes.io/cluster-service: "true"
-  name: kube-dns
-  namespace: kube-system
+    addonmanager.kubernetes.io/mode: Reconcile
 spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      k8s-app: kube-dns
+  # replicas: not specified here:
+  # 1. In order to make Addon Manager do not reconcile this replicas parameter.
+  # 2. Default is 1.
+  # 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
  strategy:
    rollingUpdate:
      maxSurge: 10%
      maxUnavailable: 0
-    type: RollingUpdate
+  selector:
+    matchLabels:
+      k8s-app: kube-dns
  template:
    metadata:
-      annotations:
-        scheduler.alpha.kubernetes.io/critical-pod: ""
-      creationTimestamp: null
      labels:
        k8s-app: kube-dns
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
-      containers:
-        - name: kubedns
-          image: gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.4
-          env:
-            - name: PROMETHEUS_PORT
-              value: "10055"
-          args:
-            - --domain=cluster.local.
-            - --dns-port=10053
-            - --config-dir=/kube-dns-config
-            - --v=2
-          livenessProbe:
-            failureThreshold: 5
-            httpGet:
-              path: /healthcheck/kubedns
-              port: 10054
-              scheme: HTTP
-            initialDelaySeconds: 60
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          ports:
-            - name: dns-local
-              containerPort: 10053
-              protocol: UDP
-            - name: dns-tcp-local
-              containerPort: 10053
-              protocol: TCP
-            - name: metrics
-              containerPort: 10055
-              protocol: TCP
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /readiness
-              port: 8081
-              scheme: HTTP
-            initialDelaySeconds: 3
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              memory: 170Mi
-            requests:
-              cpu: 100m
-              memory: 70Mi
-          volumeMounts:
-            - name: kube-dns-config
-              mountPath: /kube-dns-config
-        - name: dnsmasq
-          image: gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.4
-          args:
-            - -v=2
-            - -logtostderr
-            - -configDir=/etc/k8s/dns/dnsmasq-nanny
-            - -restartDnsmasq=true
-            - --
-            - -k
-            - --cache-size=1000
-            - --log-facility=-
-            - --server=/cluster.local/127.0.0.1#10053
-            - --server=/in-addr.arpa/127.0.0.1#10053
-            - --server=/ip6.arpa/127.0.0.1#10053
-          livenessProbe:
-            failureThreshold: 5
-            httpGet:
-              path: /healthcheck/dnsmasq
-              port: 10054
-              scheme: HTTP
-            initialDelaySeconds: 60
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          ports:
-            - name: dns
-              containerPort: 53
-              protocol: UDP
-            - name: dns-tcp
-              containerPort: 53
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 150m
-              memory: 20Mi
-          volumeMounts:
-            - name: kube-dns-config
-              mountPath: /etc/k8s/dns/dnsmasq-nanny
-        - name: sidecar
-          image: gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.4
-          args:
-            - --v=2
-            - --logtostderr
-            - --probe=kubedns,127.0.0.1:10053,kubernetes.default.svc.cluster.local,5,A
-            - --probe=dnsmasq,127.0.0.1:53,kubernetes.default.svc.cluster.local,5,A
-          livenessProbe:
-            failureThreshold: 5
-            httpGet:
-              path: /metrics
-              port: 10054
-              scheme: HTTP
-            initialDelaySeconds: 60
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          ports:
-            - name: metrics
-              containerPort: 10054
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 10m
-              memory: 20Mi
-      dnsPolicy: Default
-      restartPolicy: Always
-      serviceAccount: kube-dns
-      serviceAccountName: kube-dns
-      terminationGracePeriodSeconds: 30
      tolerations:
-        - key: CriticalAddonsOnly
-          operator: Exists
+      - key: "CriticalAddonsOnly"
+        operator: "Exists"
      volumes:
+      - name: kube-dns-config
+        configMap:
+          name: kube-dns
+          optional: true
+      containers:
+      - name: kubedns
+        image: gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.7
+        resources:
+          # TODO: Set memory limits when we've profiled the container for large
+          # clusters, then set request = limit to keep this container in
+          # guaranteed class. Currently, this container falls into the
+          # "burstable" category so the kubelet doesn't backoff from restarting it.
+          limits:
+            memory: 170Mi
+          requests:
+            cpu: 100m
+            memory: 70Mi
+        livenessProbe:
+          httpGet:
+            path: /healthcheck/kubedns
+            port: 10054
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /readiness
+            port: 8081
+            scheme: HTTP
+          # we poll on pod startup for the Kubernetes master service and
+          # only setup the /readiness HTTP server once that's available.
+          initialDelaySeconds: 3
+          timeoutSeconds: 5
+        args:
+        - --domain=cluster.local.
+        - --dns-port=10053
+        - --config-dir=/kube-dns-config
+        - --v=2
+        env:
+        - name: PROMETHEUS_PORT
+          value: "10055"
+        ports:
+        - containerPort: 10053
+          name: dns-local
+          protocol: UDP
+        - containerPort: 10053
+          name: dns-tcp-local
+          protocol: TCP
+        - containerPort: 10055
+          name: metrics
+          protocol: TCP
+        volumeMounts:
        - name: kube-dns-config
-          configMap:
-            defaultMode: 420
-            name: kube-dns
-            optional: true
+          mountPath: /kube-dns-config
+      - name: dnsmasq
+        image: gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.7
+        livenessProbe:
+          httpGet:
+            path: /healthcheck/dnsmasq
+            port: 10054
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        args:
+        - -v=2
+        - -logtostderr
+        - -configDir=/etc/k8s/dns/dnsmasq-nanny
+        - -restartDnsmasq=true
+        - --
+        - -k
+        - --cache-size=1000
+        - --no-negcache
+        - --log-facility=-
+        - --server=/cluster.local/127.0.0.1#10053
+        - --server=/in-addr.arpa/127.0.0.1#10053
+        - --server=/ip6.arpa/127.0.0.1#10053
+        ports:
+        - containerPort: 53
+          name: dns
+          protocol: UDP
+        - containerPort: 53
+          name: dns-tcp
+          protocol: TCP
+        # see: https://github.com/kubernetes/kubernetes/issues/29055 for details
+        resources:
+          requests:
+            cpu: 150m
+            memory: 20Mi
+        volumeMounts:
+        - name: kube-dns-config
+          mountPath: /etc/k8s/dns/dnsmasq-nanny
+      - name: sidecar
+        image: gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.7
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: 10054
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        args:
+        - --v=2
+        - --logtostderr
+        - --probe=kubedns,127.0.0.1:10053,kubernetes.default.svc.cluster.local,5,SRV
+        - --probe=dnsmasq,127.0.0.1:53,kubernetes.default.svc.cluster.local,5,SRV
+        ports:
+        - containerPort: 10054
+          name: metrics
+          protocol: TCP
+        resources:
+          requests:
+            memory: 20Mi
+            cpu: 10m
+      dnsPolicy: Default  # Don't use cluster DNS.
+      serviceAccountName: kube-dns
--- a/docs/01-prerequisites.md
+++ b/docs/01-prerequisites.md
@@ -14,7 +14,7 @@ This tutorial leverages the [Google Cloud Platform](https://cloud.google.com/) t

 Follow the Google Cloud SDK [documentation](https://cloud.google.com/sdk/) to install and configure the `gcloud` command line utility.

-Verify the Google Cloud SDK version is 169.0.0 or higher:
+Verify the Google Cloud SDK version is 183.0.0 or higher:

 ```
 gcloud version
@@ -24,7 +24,13 @@ gcloud version

 This tutorial assumes a default compute region and zone have been configured.

-Set a default compute region:
+If you are using the `gcloud` command-line tool for the first time `init` is the easiest way to do this:
+
+```
+gcloud init
+```
+
+Otherwise set a default compute region:

 ```
 gcloud config set compute/region us-west1
--- a/docs/02-client-tools.md
+++ b/docs/02-client-tools.md
@@ -12,21 +12,16 @@ Download and install `cfssl` and `cfssljson` from the [cfssl repository](https:/
 ### OS X

 ```
-wget -q --show-progress --https-only --timestamping \
-  https://pkg.cfssl.org/R1.2/cfssl_darwin-amd64 \
-  https://pkg.cfssl.org/R1.2/cfssljson_darwin-amd64
+curl -o cfssl https://pkg.cfssl.org/R1.2/cfssl_darwin-amd64
+curl -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_darwin-amd64
 ```

 ```
-chmod +x cfssl_darwin-amd64 cfssljson_darwin-amd64
+chmod +x cfssl cfssljson
 ```

 ```
-sudo mv cfssl_darwin-amd64 /usr/local/bin/cfssl
-```
-
-```
-sudo mv cfssljson_darwin-amd64 /usr/local/bin/cfssljson
+sudo mv cfssl cfssljson /usr/local/bin/
 ```

 ### Linux
@@ -74,7 +69,7 @@ The `kubectl` command line utility is used to interact with the Kubernetes API S
 ### OS X

 ```
-wget https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/darwin/amd64/kubectl
+curl -o kubectl https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/darwin/amd64/kubectl
 ```

 ```
@@ -88,7 +83,7 @@ sudo mv kubectl /usr/local/bin/
 ### Linux

 ```
-wget https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/linux/amd64/kubectl
+wget https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kubectl
 ```

 ```
@@ -101,7 +96,7 @@ sudo mv kubectl /usr/local/bin/

 ### Verification

-Verify `kubectl` version 1.7.4 or higher is installed:
+Verify `kubectl` version 1.9.0 or higher is installed:

 ```
 kubectl version --client
@@ -110,7 +105,7 @@ kubectl version --client
 > output

 ```
-Client Version: version.Info{Major:"1", Minor:"7", GitVersion:"v1.7.4", GitCommit:"793658f2d7ca7f064d2bdf606519f9fe1229c381", GitTreeState:"clean", BuildDate:"2017-08-17T08:48:23Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"darwin/amd64"}
+Client Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.0", GitCommit:"925c127ec6b946659ad0fd596fa959be43f0cc05", GitTreeState:"clean", BuildDate:"2017-12-15T21:07:38Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"darwin/amd64"}
 ```

 Next: [Provisioning Compute Resources](03-compute-resources.md)
--- a/docs/03-compute-resources.md
+++ b/docs/03-compute-resources.md
@@ -17,7 +17,7 @@ In this section a dedicated [Virtual Private Cloud](https://cloud.google.com/com
 Create the `kubernetes-the-hard-way` custom VPC network:

 ```
-gcloud compute networks create kubernetes-the-hard-way --mode custom
+gcloud compute networks create kubernetes-the-hard-way --subnet-mode custom
 ```

 A [subnet](https://cloud.google.com/compute/docs/vpc/#vpc_networks_and_subnets) must be provisioned with an IP address range large enough to assign a private IP address to each node in the Kubernetes cluster.
@@ -52,30 +52,20 @@ gcloud compute firewall-rules create kubernetes-the-hard-way-allow-external \
  --source-ranges 0.0.0.0/0
 ```

-Create a firewall rule that allows health check probes from the GCP [network load balancer IP ranges](https://cloud.google.com/compute/docs/load-balancing/network/#firewall_rules_and_network_load_balancing):
-
-```
-gcloud compute firewall-rules create kubernetes-the-hard-way-allow-health-checks \
-  --allow tcp:8080 \
-  --network kubernetes-the-hard-way \
-  --source-ranges 209.85.204.0/22,209.85.152.0/22,35.191.0.0/16
-```
-
 > An [external load balancer](https://cloud.google.com/compute/docs/load-balancing/network/) will be used to expose the Kubernetes API Servers to remote clients.

 List the firewall rules in the `kubernetes-the-hard-way` VPC network:

 ```
-gcloud compute firewall-rules list --filter "network kubernetes-the-hard-way"
+gcloud compute firewall-rules list --filter "network: kubernetes-the-hard-way"
 ```

 > output

 ```
-NAME                                         NETWORK                  DIRECTION  PRIORITY  ALLOW                 DENY
-kubernetes-the-hard-way-allow-external       kubernetes-the-hard-way  INGRESS    1000      tcp:22,tcp:6443,icmp
-kubernetes-the-hard-way-allow-health-checks  kubernetes-the-hard-way  INGRESS    1000      tcp:8080
-kubernetes-the-hard-way-allow-internal       kubernetes-the-hard-way  INGRESS    1000      tcp,udp,icmp
+NAME                                    NETWORK                  DIRECTION  PRIORITY  ALLOW                 DENY
+kubernetes-the-hard-way-allow-external  kubernetes-the-hard-way  INGRESS    1000      tcp:22,tcp:6443,icmp
+kubernetes-the-hard-way-allow-internal  kubernetes-the-hard-way  INGRESS    1000      tcp,udp,icmp
 ```

 ### Kubernetes Public IP Address
@@ -102,7 +92,7 @@ kubernetes-the-hard-way  us-west1  XX.XXX.XXX.XX  RESERVED

 ## Compute Instances

-The compute instances in this lab will be provisioned using [Ubuntu Server](https://www.ubuntu.com/server) 16.04, which has good support for the [CRI-O container runtime](https://github.com/kubernetes-incubator/cri-o). Each compute instance will be provisioned with a fixed private IP address to simplify the Kubernetes bootstrapping process.
+The compute instances in this lab will be provisioned using [Ubuntu Server](https://www.ubuntu.com/server) 16.04, which has good support for the [cri-containerd container runtime](https://github.com/kubernetes-incubator/cri-containerd). Each compute instance will be provisioned with a fixed private IP address to simplify the Kubernetes bootstrapping process.

 ### Kubernetes Controllers

@@ -146,7 +136,7 @@ for i in 0 1 2; do
    --scopes compute-rw,storage-ro,service-management,service-control,logging-write,monitoring \
    --subnet kubernetes \
    --tags kubernetes-the-hard-way,worker
- done
+done
 ```

 ### Verification
--- a/docs/07-bootstrapping-etcd.md
+++ b/docs/07-bootstrapping-etcd.md
@@ -18,17 +18,17 @@ Download the official etcd release binaries from the [coreos/etcd](https://githu

 ```
 wget -q --show-progress --https-only --timestamping \
-  "https://github.com/coreos/etcd/releases/download/v3.2.6/etcd-v3.2.6-linux-amd64.tar.gz"
+  "https://github.com/coreos/etcd/releases/download/v3.2.11/etcd-v3.2.11-linux-amd64.tar.gz"
 ```

 Extract and install the `etcd` server and the `etcdctl` command line utility:

 ```
-tar -xvf etcd-v3.2.6-linux-amd64.tar.gz
+tar -xvf etcd-v3.2.11-linux-amd64.tar.gz
 ```

 ```
-sudo mv etcd-v3.2.6-linux-amd64/etcd* /usr/local/bin/
+sudo mv etcd-v3.2.11-linux-amd64/etcd* /usr/local/bin/
 ```

 ### Configure the etcd Server
--- a/docs/08-bootstrapping-kubernetes-controllers.md
+++ b/docs/08-bootstrapping-kubernetes-controllers.md
@@ -18,10 +18,10 @@ Download the official Kubernetes release binaries:

 ```
 wget -q --show-progress --https-only --timestamping \
-  "https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/linux/amd64/kube-apiserver" \
-  "https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/linux/amd64/kube-controller-manager" \
-  "https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/linux/amd64/kube-scheduler" \
-  "https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/linux/amd64/kubectl"
+  "https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kube-apiserver" \
+  "https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kube-controller-manager" \
+  "https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kube-scheduler" \
+  "https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kubectl"
 ```

 Install the Kubernetes binaries:
@@ -57,11 +57,11 @@ Create the `kube-apiserver.service` systemd unit file:
 cat > kube-apiserver.service <<EOF
 [Unit]
 Description=Kubernetes API Server
-Documentation=https://github.com/GoogleCloudPlatform/kubernetes
+Documentation=https://github.com/kubernetes/kubernetes

 [Service]
 ExecStart=/usr/local/bin/kube-apiserver \\
-  --admission-control=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \\
+  --admission-control=Initializers,NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \\
  --advertise-address=${INTERNAL_IP} \\
  --allow-privileged=true \\
  --apiserver-count=3 \\
@@ -79,12 +79,12 @@ ExecStart=/usr/local/bin/kube-apiserver \\
  --etcd-servers=https://10.240.0.10:2379,https://10.240.0.11:2379,https://10.240.0.12:2379 \\
  --event-ttl=1h \\
  --experimental-encryption-provider-config=/var/lib/kubernetes/encryption-config.yaml \\
-  --insecure-bind-address=0.0.0.0 \\
+  --insecure-bind-address=127.0.0.1 \\
  --kubelet-certificate-authority=/var/lib/kubernetes/ca.pem \\
  --kubelet-client-certificate=/var/lib/kubernetes/kubernetes.pem \\
  --kubelet-client-key=/var/lib/kubernetes/kubernetes-key.pem \\
  --kubelet-https=true \\
-  --runtime-config=rbac.authorization.k8s.io/v1alpha1 \\
+  --runtime-config=api/all \\
  --service-account-key-file=/var/lib/kubernetes/ca-key.pem \\
  --service-cluster-ip-range=10.32.0.0/24 \\
  --service-node-port-range=30000-32767 \\
@@ -108,7 +108,7 @@ Create the `kube-controller-manager.service` systemd unit file:
 cat > kube-controller-manager.service <<EOF
 [Unit]
 Description=Kubernetes Controller Manager
-Documentation=https://github.com/GoogleCloudPlatform/kubernetes
+Documentation=https://github.com/kubernetes/kubernetes

 [Service]
 ExecStart=/usr/local/bin/kube-controller-manager \\
@@ -118,10 +118,10 @@ ExecStart=/usr/local/bin/kube-controller-manager \\
  --cluster-signing-cert-file=/var/lib/kubernetes/ca.pem \\
  --cluster-signing-key-file=/var/lib/kubernetes/ca-key.pem \\
  --leader-elect=true \\
-  --master=http://${INTERNAL_IP}:8080 \\
+  --master=http://127.0.0.1:8080 \\
  --root-ca-file=/var/lib/kubernetes/ca.pem \\
  --service-account-private-key-file=/var/lib/kubernetes/ca-key.pem \\
-  --service-cluster-ip-range=10.32.0.0/16 \\
+  --service-cluster-ip-range=10.32.0.0/24 \\
  --v=2
 Restart=on-failure
 RestartSec=5
@@ -139,12 +139,12 @@ Create the `kube-scheduler.service` systemd unit file:
 cat > kube-scheduler.service <<EOF
 [Unit]
 Description=Kubernetes Scheduler
-Documentation=https://github.com/GoogleCloudPlatform/kubernetes
+Documentation=https://github.com/kubernetes/kubernetes

 [Service]
 ExecStart=/usr/local/bin/kube-scheduler \\
  --leader-elect=true \\
-  --master=http://${INTERNAL_IP}:8080 \\
+  --master=http://127.0.0.1:8080 \\
  --v=2
 Restart=on-failure
 RestartSec=5
@@ -182,15 +182,73 @@ kubectl get componentstatuses

 ```
 NAME                 STATUS    MESSAGE              ERROR
-controller-manager   Healthy   ok                   
-scheduler            Healthy   ok                   
-etcd-2               Healthy   {"health": "true"}   
-etcd-0               Healthy   {"health": "true"}   
+controller-manager   Healthy   ok
+scheduler            Healthy   ok
+etcd-2               Healthy   {"health": "true"}
+etcd-0               Healthy   {"health": "true"}
 etcd-1               Healthy   {"health": "true"}
 ```

 > Remember to run the above commands on each controller node: `controller-0`, `controller-1`, and `controller-2`.

+## RBAC for Kubelet Authorization
+
+In this section you will configure RBAC permissions to allow the Kubernetes API Server to access the Kubelet API on each worker node. Access to the Kubelet API is required for retrieving metrics, logs, and executing commands in pods.
+
+> This tutorial sets the Kubelet `--authorization-mode` flag to `Webhook`. Webhook mode uses the [SubjectAccessReview](https://kubernetes.io/docs/admin/authorization/#checking-api-access) API to determine authorization.
+
+```
+gcloud compute ssh controller-0
+```
+
+Create the `system:kube-apiserver-to-kubelet` [ClusterRole](https://kubernetes.io/docs/admin/authorization/rbac/#role-and-clusterrole) with permissions to access the Kubelet API and perform most common tasks associated with managing pods:
+
+```
+cat <<EOF | kubectl apply -f -
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  annotations:
+    rbac.authorization.kubernetes.io/autoupdate: "true"
+  labels:
+    kubernetes.io/bootstrapping: rbac-defaults
+  name: system:kube-apiserver-to-kubelet
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes/proxy
+      - nodes/stats
+      - nodes/log
+      - nodes/spec
+      - nodes/metrics
+    verbs:
+      - "*"
+EOF
+```
+
+The Kubernetes API Server authenticates to the Kubelet as the `kubernetes` user using the client certificate as defined by the `--kubelet-client-certificate` flag.
+
+Bind the `system:kube-apiserver-to-kubelet` ClusterRole to the `kubernetes` user:
+
+```
+cat <<EOF | kubectl apply -f -
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: system:kube-apiserver
+  namespace: ""
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:kube-apiserver-to-kubelet
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: User
+    name: kubernetes
+EOF
+```
+
 ## The Kubernetes Frontend Load Balancer

 In this section you will provision an external load balancer to front the Kubernetes API Servers. The `kubernetes-the-hard-way` static IP address will be attached to the resulting load balancer.
@@ -200,15 +258,7 @@ In this section you will provision an external load balancer to front the Kubern
 Create the external load balancer network resources:

 ```
-gcloud compute http-health-checks create kube-apiserver-health-check \
-  --description "Kubernetes API Server Health Check" \
-  --port 8080 \
-  --request-path /healthz
-```
-
-```
-gcloud compute target-pools create kubernetes-target-pool \
-  --http-health-check=kube-apiserver-health-check
+gcloud compute target-pools create kubernetes-target-pool
 ```

 ```
@@ -235,7 +285,7 @@ gcloud compute forwarding-rules create kubernetes-forwarding-rule \
 Retrieve the `kubernetes-the-hard-way` static IP address:

 ```
-KUBERNETES_PUBLIC_IP_ADDRESS=$(gcloud compute addresses describe kubernetes-the-hard-way \
+KUBERNETES_PUBLIC_ADDRESS=$(gcloud compute addresses describe kubernetes-the-hard-way \
  --region $(gcloud config get-value compute/region) \
  --format 'value(address)')
 ```
@@ -243,7 +293,7 @@ KUBERNETES_PUBLIC_IP_ADDRESS=$(gcloud compute addresses describe kubernetes-the-
 Make a HTTP request for the Kubernetes version info:

 ```
-curl --cacert ca.pem https://${KUBERNETES_PUBLIC_IP_ADDRESS}:6443/version
+curl --cacert ca.pem https://${KUBERNETES_PUBLIC_ADDRESS}:6443/version
 ```

 > output
@@ -251,12 +301,12 @@ curl --cacert ca.pem https://${KUBERNETES_PUBLIC_IP_ADDRESS}:6443/version
 ```
 {
  "major": "1",
-  "minor": "7",
-  "gitVersion": "v1.7.4",
-  "gitCommit": "793658f2d7ca7f064d2bdf606519f9fe1229c381",
+  "minor": "9",
+  "gitVersion": "v1.9.0",
+  "gitCommit": "925c127ec6b946659ad0fd596fa959be43f0cc05",
  "gitTreeState": "clean",
-  "buildDate": "2017-08-17T08:30:51Z",
-  "goVersion": "go1.8.3",
+  "buildDate": "2017-12-15T20:55:30Z",
+  "goVersion": "go1.9.2",
  "compiler": "gc",
  "platform": "linux/amd64"
 }
--- a/docs/09-bootstrapping-kubernetes-workers.md
+++ b/docs/09-bootstrapping-kubernetes-workers.md
@@ -1,6 +1,6 @@
 # Bootstrapping the Kubernetes Worker Nodes

-In this lab you will bootstrap three Kubernetes worker nodes. The following components will be installed on each node: [runc](https://github.com/opencontainers/runc), [container networking plugins](https://github.com/containernetworking/cni), [cri-o](https://github.com/kubernetes-incubator/cri-o), [kubelet](https://kubernetes.io/docs/admin/kubelet), and [kube-proxy](https://kubernetes.io/docs/concepts/cluster-administration/proxies).
+In this lab you will bootstrap three Kubernetes worker nodes. The following components will be installed on each node: [runc](https://github.com/opencontainers/runc), [container networking plugins](https://github.com/containernetworking/cni), [cri-containerd](https://github.com/kubernetes-incubator/cri-containerd), [kubelet](https://kubernetes.io/docs/admin/kubelet), and [kube-proxy](https://kubernetes.io/docs/concepts/cluster-administration/proxies).

 ## Prerequisites

@@ -12,45 +12,31 @@ gcloud compute ssh worker-0

 ## Provisioning a Kubernetes Worker Node

-### Install the cri-o OS Dependencies
-
-Add the `alexlarsson/flatpak` [PPA](https://launchpad.net/ubuntu/+ppas) which hosts the `libostree` package:
+Install the OS dependencies:

 ```
-sudo add-apt-repository -y ppa:alexlarsson/flatpak
+sudo apt-get -y install socat
 ```

-```
-sudo apt-get update
-```
-
-Install the OS dependencies required by the cri-o container runtime:
-
-```
-sudo apt-get install -y socat libgpgme11 libostree-1-1
-```
+> The socat binary enables support for the `kubectl port-forward` command.

 ### Download and Install Worker Binaries

 ```
 wget -q --show-progress --https-only --timestamping \
  https://github.com/containernetworking/plugins/releases/download/v0.6.0/cni-plugins-amd64-v0.6.0.tgz \
-  https://github.com/opencontainers/runc/releases/download/v1.0.0-rc4/runc.amd64 \
-  https://storage.googleapis.com/kubernetes-the-hard-way/crio-amd64-v1.0.0-beta.0.tar.gz \
-  https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/linux/amd64/kubectl \
-  https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/linux/amd64/kube-proxy \
-  https://storage.googleapis.com/kubernetes-release/release/v1.7.4/bin/linux/amd64/kubelet
+  https://github.com/kubernetes-incubator/cri-containerd/releases/download/v1.0.0-beta.0/cri-containerd-1.0.0-beta.0.linux-amd64.tar.gz \
+  https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kubectl \
+  https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kube-proxy \
+  https://storage.googleapis.com/kubernetes-release/release/v1.9.0/bin/linux/amd64/kubelet
 ```

 Create the installation directories:

 ```
 sudo mkdir -p \
-  /etc/containers \
  /etc/cni/net.d \
-  /etc/crio \
  /opt/cni/bin \
-  /usr/local/libexec/crio \
  /var/lib/kubelet \
  /var/lib/kube-proxy \
  /var/lib/kubernetes \
@@ -64,26 +50,17 @@ sudo tar -xvf cni-plugins-amd64-v0.6.0.tgz -C /opt/cni/bin/
 ```

 ```
-tar -xvf crio-amd64-v1.0.0-beta.0.tar.gz
+sudo tar -xvf cri-containerd-1.0.0-beta.0.linux-amd64.tar.gz -C /
 ```

 ```
-chmod +x kubectl kube-proxy kubelet runc.amd64
+chmod +x kubectl kube-proxy kubelet
 ```

 ```
-sudo mv runc.amd64 /usr/local/bin/runc
+sudo mv kubectl kube-proxy kubelet /usr/local/bin/
 ```

-```
-sudo mv crio crioctl kpod kubectl kube-proxy kubelet /usr/local/bin/
-```
-
-```
-sudo mv conmon pause /usr/local/libexec/crio/
-```
-
-
 ### Configure CNI Networking

 Retrieve the Pod CIDR range for the current compute instance:
@@ -132,33 +109,6 @@ Move the network configuration files to the CNI configuration directory:
 sudo mv 10-bridge.conf 99-loopback.conf /etc/cni/net.d/
 ```

-
-### Configure the CRI-O Container Runtime
-
-```
-sudo mv crio.conf seccomp.json /etc/crio/
-```
-
-```
-sudo mv policy.json /etc/containers/
-```
-
-```
-cat > crio.service <<EOF
-[Unit]
-Description=CRI-O daemon
-Documentation=https://github.com/kubernetes-incubator/cri-o
-
-[Service]
-ExecStart=/usr/local/bin/crio
-Restart=always
-RestartSec=10s
-
-[Install]
-WantedBy=multi-user.target
-EOF
-```
-
 ### Configure the Kubelet

 ```
@@ -179,26 +129,27 @@ Create the `kubelet.service` systemd unit file:
 cat > kubelet.service <<EOF
 [Unit]
 Description=Kubernetes Kubelet
-Documentation=https://github.com/GoogleCloudPlatform/kubernetes
-After=crio.service
-Requires=crio.service
+Documentation=https://github.com/kubernetes/kubernetes
+After=cri-containerd.service
+Requires=cri-containerd.service

 [Service]
 ExecStart=/usr/local/bin/kubelet \\
  --allow-privileged=true \\
+  --anonymous-auth=false \\
+  --authorization-mode=Webhook \\
+  --client-ca-file=/var/lib/kubernetes/ca.pem \\
+  --cloud-provider= \\
  --cluster-dns=10.32.0.10 \\
  --cluster-domain=cluster.local \\
  --container-runtime=remote \\
-  --container-runtime-endpoint=unix:///var/run/crio.sock \\
-  --enable-custom-metrics \\
+  --container-runtime-endpoint=unix:///var/run/cri-containerd.sock \\
  --image-pull-progress-deadline=2m \\
-  --image-service-endpoint=unix:///var/run/crio.sock \\
  --kubeconfig=/var/lib/kubelet/kubeconfig \\
  --network-plugin=cni \\
  --pod-cidr=${POD_CIDR} \\
  --register-node=true \\
-  --require-kubeconfig \\
-  --runtime-request-timeout=10m \\
+  --runtime-request-timeout=15m \\
  --tls-cert-file=/var/lib/kubelet/${HOSTNAME}.pem \\
  --tls-private-key-file=/var/lib/kubelet/${HOSTNAME}-key.pem \\
  --v=2
@@ -222,7 +173,7 @@ Create the `kube-proxy.service` systemd unit file:
 cat > kube-proxy.service <<EOF
 [Unit]
 Description=Kubernetes Kube Proxy
-Documentation=https://github.com/GoogleCloudPlatform/kubernetes
+Documentation=https://github.com/kubernetes/kubernetes

 [Service]
 ExecStart=/usr/local/bin/kube-proxy \\
@@ -241,7 +192,7 @@ EOF
 ### Start the Worker Services

 ```
-sudo mv crio.service kubelet.service kube-proxy.service /etc/systemd/system/
+sudo mv kubelet.service kube-proxy.service /etc/systemd/system/
 ```

 ```
@@ -249,11 +200,11 @@ sudo systemctl daemon-reload
 ```

 ```
-sudo systemctl enable crio kubelet kube-proxy
+sudo systemctl enable containerd cri-containerd kubelet kube-proxy
 ```

 ```
-sudo systemctl start crio kubelet kube-proxy
+sudo systemctl start containerd cri-containerd kubelet kube-proxy
 ```

 > Remember to run the above commands on each worker node: `worker-0`, `worker-1`, and `worker-2`.
@@ -275,10 +226,10 @@ kubectl get nodes
 > output

 ```
-NAME       STATUS    AGE       VERSION
-worker-0   Ready     5m        v1.7.4
-worker-1   Ready     3m        v1.7.4
-worker-2   Ready     7s        v1.7.4
+NAME       STATUS    ROLES     AGE       VERSION
+worker-0   Ready     <none>    18s       v1.9.0
+worker-1   Ready     <none>    18s       v1.9.0
+worker-2   Ready     <none>    18s       v1.9.0
 ```

 Next: [Configuring kubectl for Remote Access](10-configuring-kubectl.md)
--- a/docs/10-configuring-kubectl.md
+++ b/docs/10-configuring-kubectl.md
@@ -53,11 +53,11 @@ kubectl get componentstatuses

 ```
 NAME                 STATUS    MESSAGE              ERROR
-controller-manager   Healthy   ok                   
-scheduler            Healthy   ok                   
-etcd-2               Healthy   {"health": "true"}   
-etcd-0               Healthy   {"health": "true"}   
-etcd-1               Healthy   {"health": "true"}  
+controller-manager   Healthy   ok
+scheduler            Healthy   ok
+etcd-2               Healthy   {"health": "true"}
+etcd-0               Healthy   {"health": "true"}
+etcd-1               Healthy   {"health": "true"}
 ```

 List the nodes in the remote Kubernetes cluster:
@@ -69,10 +69,10 @@ kubectl get nodes
 > output

 ```
-NAME       STATUS    AGE       VERSION
-worker-0   Ready     7m        v1.7.4
-worker-1   Ready     4m        v1.7.4
-worker-2   Ready     1m        v1.7.4
+NAME       STATUS    ROLES     AGE       VERSION
+worker-0   Ready     <none>    1m        v1.9.0
+worker-1   Ready     <none>    1m        v1.9.0
+worker-2   Ready     <none>    1m        v1.9.0
 ```

 Next: [Provisioning Pod Network Routes](11-pod-network-routes.md)
--- a/docs/11-pod-network-routes.md
+++ b/docs/11-pod-network-routes.md
@@ -43,15 +43,15 @@ done
 List the routes in the `kubernetes-the-hard-way` VPC network:

 ```
-gcloud compute routes list --filter "network kubernetes-the-hard-way"
+gcloud compute routes list --filter "network: kubernetes-the-hard-way"
 ```

 > output

 ```
 NAME                            NETWORK                  DEST_RANGE     NEXT_HOP                  PRIORITY
-default-route-77bcc6bee33b5535  kubernetes-the-hard-way  10.240.0.0/24                            1000
-default-route-b11fc914b626974d  kubernetes-the-hard-way  0.0.0.0/0      default-internet-gateway  1000
+default-route-236a40a8bc992b5b  kubernetes-the-hard-way  0.0.0.0/0      default-internet-gateway  1000
+default-route-df77b1e818a56b30  kubernetes-the-hard-way  10.240.0.0/24                            1000
 kubernetes-route-10-200-0-0-24  kubernetes-the-hard-way  10.200.0.0/24  10.240.0.20               1000
 kubernetes-route-10-200-1-0-24  kubernetes-the-hard-way  10.200.1.0/24  10.240.0.21               1000
 kubernetes-route-10-200-2-0-24  kubernetes-the-hard-way  10.200.2.0/24  10.240.0.22               1000
--- a/docs/13-smoke-test.md
+++ b/docs/13-smoke-test.md
@@ -27,19 +27,18 @@ gcloud compute ssh controller-0 \
 00000010  73 2f 64 65 66 61 75 6c  74 2f 6b 75 62 65 72 6e  |s/default/kubern|
 00000020  65 74 65 73 2d 74 68 65  2d 68 61 72 64 2d 77 61  |etes-the-hard-wa|
 00000030  79 0a 6b 38 73 3a 65 6e  63 3a 61 65 73 63 62 63  |y.k8s:enc:aescbc|
-00000040  3a 76 31 3a 6b 65 79 31  3a 70 88 d8 52 83 b7 96  |:v1:key1:p..R...|
-00000050  04 a3 bd 7e 42 9e 8a 77  2f 97 24 a7 68 3f c5 ec  |...~B..w/.$.h?..|
-00000060  9e f7 66 e8 a3 81 fc c8  3c df 63 71 33 0a 87 8f  |..f.....<.cq3...|
-00000070  0e c7 0a 0a f2 04 46 85  33 92 9a 4b 61 b2 10 c0  |......F.3..Ka...|
-00000080  0b 00 05 dd c3 c2 d0 6b  ff ff f2 32 3b e0 ec a0  |.......k...2;...|
-00000090  63 d3 8b 1c 29 84 88 71  a7 88 e2 26 4b 65 95 14  |c...)..q...&Ke..|
-000000a0  dc 8d 59 63 11 e5 f3 4e  b4 94 cc 3d 75 52 c7 07  |..Yc...N...=uR..|
-000000b0  73 f5 b4 b0 63 aa f9 9d  29 f8 d6 88 aa 33 c4 24  |s...c...)....3.$|
-000000c0  ac c6 71 2b 45 98 9e 5f  c6 a4 9d a2 26 3c 24 41  |..q+E.._....&<$A|
-000000d0  95 5b d3 2c 4b 1e 4a 47  c8 47 c8 f3 ac d6 e8 cb  |.[.,K.JG.G......|
-000000e0  5f a9 09 93 91 d7 5d c9  c2 68 f8 cf 3c 7e 3b a3  |_.....]..h..<~;.|
-000000f0  db d8 d5 9e 0c bf 2a 2f  58 0a                    |......*/X.|
-000000fa
+00000040  3a 76 31 3a 6b 65 79 31  3a ea 7c 76 32 43 62 6f  |:v1:key1:.|v2Cbo|
+00000050  44 02 02 8c b7 ca fe 95  a5 33 f6 a1 18 6c 3d 53  |D........3...l=S|
+00000060  e7 9c 51 ee 32 f6 e4 17  ea bb 11 d5 2f e2 40 00  |..Q.2......./.@.|
+00000070  ae cf d9 e7 ba 7f 68 18  d3 c1 10 10 93 43 35 bd  |......h......C5.|
+00000080  24 dd 66 b4 f8 f9 82 77  4a d5 78 03 19 41 1e bc  |$.f....wJ.x..A..|
+00000090  94 3f 17 41 ad cc 8c ba  9f 8f 8e 56 97 7e 96 fb  |.?.A.......V.~..|
+000000a0  8f 2e 6a a5 bf 08 1f 0b  c3 4b 2b 93 d1 ec f8 70  |..j......K+....p|
+000000b0  c1 e4 1d 1a d2 0d f8 74  3a a1 4f 3c e0 c9 6d 3f  |.......t:.O<..m?|
+000000c0  de a3 f5 fd 76 aa 5e bc  27 d9 3c 6b 8f 54 97 45  |....v.^.'.<k.T.E|
+000000d0  31 25 ff 23 90 a4 2a f2  db 78 b1 3b ca 21 f3 6b  |1%.#..*..x.;.!.k|
+000000e0  dd fb 8e 53 c6 23 0d 35  c8 0a                    |...S.#.5..|
+000000ea
 ```

 The etcd key should be prefixed with `k8s:enc:aescbc:v1:key1`, which indicates the `aescbc` provider was used to encrypt the data with the `key1` encryption key.
@@ -100,13 +99,13 @@ curl --head http://127.0.0.1:8080

 ```
 HTTP/1.1 200 OK
-Server: nginx/1.13.3
-Date: Thu, 31 Aug 2017 01:58:15 GMT
+Server: nginx/1.13.7
+Date: Mon, 18 Dec 2017 14:50:36 GMT
 Content-Type: text/html
 Content-Length: 612
-Last-Modified: Tue, 11 Jul 2017 13:06:07 GMT
+Last-Modified: Tue, 21 Nov 2017 14:28:04 GMT
 Connection: keep-alive
-ETag: "5964cd3f-264"
+ETag: "5a1437f4-264"
 Accept-Ranges: bytes
 ```

@@ -132,7 +131,7 @@ kubectl logs $POD_NAME
 > output

 ```
-127.0.0.1 - - [31/Aug/2017:01:58:15 +0000] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.54.0" "-"
+127.0.0.1 - - [18/Dec/2017:14:50:36 +0000] "HEAD / HTTP/1.1" 200 0 "-" "curl/7.54.0" "-"
 ```

 ### Exec
@@ -148,7 +147,7 @@ kubectl exec -ti $POD_NAME -- nginx -v
 > output

 ```
-nginx version: nginx/1.13.3
+nginx version: nginx/1.13.7
 ```

 ## Services
@@ -195,13 +194,13 @@ curl -I http://${EXTERNAL_IP}:${NODE_PORT}

 ```
 HTTP/1.1 200 OK
-Server: nginx/1.13.3
-Date: Thu, 31 Aug 2017 02:00:21 GMT
+Server: nginx/1.13.7
+Date: Mon, 18 Dec 2017 14:52:09 GMT
 Content-Type: text/html
 Content-Length: 612
-Last-Modified: Tue, 11 Jul 2017 13:06:07 GMT
+Last-Modified: Tue, 21 Nov 2017 14:28:04 GMT
 Connection: keep-alive
-ETag: "5964cd3f-264"
+ETag: "5a1437f4-264"
 Accept-Ranges: bytes
 ```

--- a/docs/14-cleanup.md
+++ b/docs/14-cleanup.md
@@ -4,7 +4,7 @@ In this labs you will delete the compute resources created during this tutorial.

 ## Compute Instances

-Delete the controller and worker compute instances:  
+Delete the controller and worker compute instances:

 ```
 gcloud -q compute instances delete \
@@ -25,10 +25,6 @@ gcloud -q compute forwarding-rules delete kubernetes-forwarding-rule \
 gcloud -q compute target-pools delete kubernetes-target-pool
 ```

-```
-gcloud -q compute http-health-checks delete kube-apiserver-health-check
-```
-
 Delete the `kubernetes-the-hard-way` static IP address:

 ```
@@ -41,8 +37,7 @@ Delete the `kubernetes-the-hard-way` firewall rules:
 gcloud -q compute firewall-rules delete \
  kubernetes-the-hard-way-allow-nginx-service \
  kubernetes-the-hard-way-allow-internal \
-  kubernetes-the-hard-way-allow-external \
-  kubernetes-the-hard-way-allow-health-checks
+  kubernetes-the-hard-way-allow-external
 ```

 Delete the Pod network routes:
Author	SHA1	Message	Date
Kelsey Hightower	63ff9932d9	update kubelet flags	2017-12-18 07:20:15 -08:00
Kelsey Hightower	af9f6d71fc	update kubernetes GitHub location	2017-12-18 07:07:54 -08:00
Kelsey Hightower	2c78297922	rename to Google Kubernetes Engine	2017-12-18 06:58:00 -08:00
Kelsey Hightower	07aae4fb45	update to kubernetes 1.9	2017-12-18 06:53:32 -08:00
Kelsey Hightower	e8d728d016	remove remote access to insecure port	2017-10-02 06:48:09 -07:00
Kelsey Hightower	765c1fb5fa	remove remote access to insecure port	2017-10-02 06:46:01 -07:00
Kelsey Hightower	ede3437ee8	update to kubernetes 1.8	2017-10-01 20:37:09 -07:00
Steven Trescinski	7f7fd71874	Fixed '--service-cluster-ip-range' subnet for Controller Manager	2017-10-01 12:11:33 -07:00
Kalimar Maia	51e8709080	Instructions for having a default configuration.	2017-10-01 12:11:05 -07:00
Frank Ederveen	92772d2f69	226: use curl for OSX downloads	2017-10-01 12:10:39 -07:00
Leonardo Faoro	b7550ca7ab	remove trailing space	2017-09-04 16:08:43 -07:00
Leonardo Faoro	4441278561	remove trailing-spaces and blank lines	2017-09-04 16:08:43 -07:00