anchor.diff:    ccdb:
       roles:
       - name: ccadmin
  -      password: CCDB_PASSWORD
  +      password: CCDB-PASSWORD
     uaadb:
       roles:
         - name: uaaadmin
  -        password: UAADB_PASSWORD
  +        password: UAADB-PASSWORD
     databases:
       roles:
       - name: ccadmin
  -      password: CCDB_PASSWORD
  +      password: CCDB-PASSWORD
       - name: uaaadmin
  -      password: UAADB_PASSWORD
  +      password: UAADB-PASSWORD
       - name: diego
  -      password: DIEGODB_PASSWORD
  -    </code></pre></td>
  -    <td>Replace <code>CCDB_PASSWORD</code>, <code>UAADB_PASSWORD</code>, and <code>DIEGODB_PASSWORD</code>with secure passwords of your choosing.
  +      password: DIEGODB-PASSWORD
  +    </code></pre></td>
  +    <td>Replace <code>CCDB-PASSWORD</code>, <code>UAADB-PASSWORD</code>, and <code>DIEGODB-PASSWORD</code> with secure passwords of your choosing.
       </td>
     </tr>
     <tr>
       <td><pre><code>
     login:
       saml:
  -      serviceProviderKey: SAML_KEY
  +      serviceProviderKey: SAML-KEY
         serviceProviderKeyPassword: ''
  -      serviceProviderCertificate: SAML_CERT
  +      serviceProviderCertificate: SAML-CERT
       </code></pre></td>
       <td>
  -        Generate a PEM-encoded RSA key pair. You can generate a key pair by running the command
  -        <code>openssl req -x509 -nodes -newkey rsa:2048 -days 365 -keyout key.pem -out cert.pem</code>
  -        This command creates <code>cert.pem</code>, which contains your public key, and <code>key.pem</code>,
  -        which contains your private key. Replace <code>SERVICE_PROVIDER_PRIVATE_KEY</code> with the full private key,
  -        including the <code>BEGIN</code> and <code>END</code> delimiter lines, under <code>serviceProviderKey</code>.</br>
  -        For RSA keys, you only need to configure the private key.
  +        Generate a PEM-encoded RSA key pair. Run <code>openssl req -x509 -nodes -newkey rsa:2048 -days 365 -keyout key.pem -out cert.pem</code> to generate a key pair. This command creates <code>cert.pem</code>, which contains your public key, and <code>key.pem</code>, which contains your private key. Replace <code>SERVICE-PROVIDER-PRIVATE-KEY</code> with the full private key, including the <code>BEGIN</code> and <code>END</code> delimiter lines, under <code>serviceProviderKey</code>.</br>
  +For RSA keys, you only need to configure the private key.
       </td>
     </tr>
     <tr>
  
positive.code:           <th>with the contents of this file&hellip;</th>
          </tr>
          <tr>
            <td><code>LOGGREGATOR_CA_CERT</code></td>
            <td><code>loggregator-ca.crt</code></td>
          </tr>
          <tr>
            <td><code>DOPPLER_CERT</code></td>
            <td><code>doppler.crt</code></td>
          </tr>
          <tr>
            <td><code>DOPPLER_KEY</code></td>
            <td><code>doppler.key</code></td>
          </tr>
          <tr>
            <td><code>TRAFFICCONTROLLER_CERT</code></td>
            <td><code>trafficcontroller.crt</code></td>
          </tr>
          <tr>
            <td><code>TRAFFICCONTROLLER_KEY</code></td>
            <td><code>trafficontroller.key</code></td>
          </tr>
          <tr>
            <td><code>METRON_CERT</code></td>
            <td><code>metron.crt</code></td>
          </tr>
          <tr>
            <td><code>METRON_KEY</code></td>
            <td><code>metron.key</code></td>
          </tr>
          <tr>
            <td><code>CCTRAFFICCONTROLLER_CERT</code></td>
            <td><code>cc_trafficcontroller.crt</code></td>
          </tr>
          <tr>
            <td><code>CCTRAFFICCONTROLLER_KEY</code></td>
            <td><code>cc_trafficcontroller.key</code></td>
          </tr>
          <tr>
            <td><code>SYSLOGDRAINBINDER_CERT</code></td>
            <td><code>syslogdrainbinder.crt</code></td>
          </tr>
          <tr>
            <td><code>SYSLOGDRAINBINDER_KEY</code></td>
            <td><code>syslogdrainbinder.key</code></td>
          </tr>
          <tr>
            <td><code>STATSDINJECTOR_CERT</code></td>
            <td><code>statsdinjector.crt</code></td>
          </tr>
          <tr>
            <td><code>STATSDINJECTOR_KEY</code></td>
            <td><code>statsdinjector.key</code></td>
          </tr>
        </table>
  
negative.code:   <tr>
      <td><pre><code>
    loggregator_endpoint:
      shared_secret: LOGGREGATOR-ENDPOINT-SHARED-SECRET
      </code></pre></td>
      <td>Replace <code>LOGGREGATOR-ENDPOINT-SHARED-SECRET</code> with a secure string that you generate.
      </td>
    </tr>
    <tr>
      <td><pre><code>
    nats:
      user: NATS-USER
      password: NATS-PASSWORD
      </code></pre></td>
      <td>Replace <code>NATS-USER</code> and <code>NATS-PASSWORD</code> with a username and secure password of your choosing. Cloud Foundry components use these credentials to communicate with each other over the NATS message bus.
        </td>
    </tr>
    <tr>
      <td><pre><code>
    router:
      status:
        user: ROUTER-USER
        password: ROUTER-PASSWORD
      </code></pre></td>
      <td>
        Replace <code>ROUTER-USER</code> and <code>ROUTER-PASSWORD</code> with a username and secure password of your choosing.
        </td>
    </tr>
    <tr>
      <td><pre><code>
    uaa:
      admin:
        client_secret: ADMIN-SECRET
      cc:
        client_secret: CC-CLIENT-SECRET
      clients:
        cc_service_key_client:
          secret: CC-SERVICE-KEY-CLIENT-SECRET
        cc_routing:
          secret: CC-ROUTING-SECRET
        cloud_controller_username_lookup:
          secret: CLOUD-CONTROLLER-USERNAME-LOOKUP-SECRET
        doppler:
          secret: DOPPLER-SECRET
        gorouter:
          secret: GOROUTER-SECRET
        tcp_emitter:
          secret: TCP-EMITTER-SECRET
        tcp_router:
          secret: TCP-ROUTER-SECRET
        login:
          secret: LOGIN-CLIENT-SECRET
        notifications:
          secret: NOTIFICATIONS-CLIENT-SECRET
        cc-service-dashboards:
          secret: CC-SERVICE-DASHBOARDS-SECRET
      </code></pre></td>
      <td>Replace the values for all <code>secret</code> keys with secure secrets that you generate. <br><br>You can configure container-to-container networking in this section. If you want to deploy container-to-container networking, see the <i>Enable on an IaaS</i> section of the <a href="../../devguide/deploy-apps/cf-networking.html#iaas">Administering Container-to-Container Networking</a> topic, beginning with step 4.
      </td>
  