Merge branch 'master' into hyq-0427

content/en/docs/concepts/configuration/pod-priority-preemption.md

@@ -353,21 +353,22 @@ the removal of the lowest priority Pods is not sufficient to allow the scheduler
 to schedule the preemptor Pod, or if the lowest priority Pods are protected by
 `PodDisruptionBudget`.
 
-The only component that considers both QoS and Pod priority is
-[kubelet out-of-resource eviction](/docs/tasks/administer-cluster/out-of-resource/).
-The kubelet ranks Pods for eviction first by whether or not their usage of the
-starved resource exceeds requests, then by Priority, and then by the consumption
-of the starved compute resource relative to the Pods' scheduling requests.
-See
-[evicting end-user pods](/docs/tasks/administer-cluster/out-of-resource/#evicting-end-user-pods)
+The kubelet uses Priority to determine pod order for [out-of-resource eviction](/docs/tasks/administer-cluster/out-of-resource/).
+You can use the QoS class to estimate the order in which pods are most likely
+to get evicted. The kubelet ranks pods for eviction based on the following factors:
+
+  1. Whether the starved resource usage exceeds requests
+  1. Pod Priority
+  1. Amount of resource usage relative to requests 
+
+See [evicting end-user pods](/docs/tasks/administer-cluster/out-of-resource/#evicting-end-user-pods)
 for more details.
 
 kubelet out-of-resource eviction does not evict Pods when their
 usage does not exceed their requests. If a Pod with lower priority is not
 exceeding its requests, it won't be evicted. Another Pod with higher priority
 that exceeds its requests may be evicted.
 
-
 ## {{% heading "whatsnext" %}}
 
 * Read about using ResourceQuotas in connection with PriorityClasses: [limit Priority Class consumption by default](/docs/concepts/policy/resource-quotas/#limit-priority-class-consumption-by-default)

content/en/docs/reference/access-authn-authz/authentication.md

@@ -205,12 +205,10 @@ spec:
 ```
 
 Service account bearer tokens are perfectly valid to use outside the cluster and
-
 can be used to create identities for long standing jobs that wish to talk to the
-Kubernetes API. To manually create a service account, simply use the `kubectl`
-
-create serviceaccount (NAME)` command. This creates a service account in the
-current namespace and an associated secret.
+Kubernetes API. To manually create a service account, use the `kubectl create
+serviceaccount (NAME)` command. This creates a service account in the current
+namespace and an associated secret.
 
 ```bash
 kubectl create serviceaccount jenkins