anchor.diff:      Where:
       + `MY-ENV` is the name of the BOSH Director.
       + `MY-DEPLOYMENT` is the name of your deployment.
  -    + `MANIFEST-YAML` is the name of the manifest YAML file you used when you deployed CF.
  -    + `VARIABLES-YAML` is the name of the variables YAML file you used when you deployed CF.
  +    + `MANIFEST-YAML` is the name of the manifest YAML file you used when you deployed Cloud Foundry.
  +    + `VARIABLES-YAML` is the name of the variables YAML file you used when you deployed Cloud Foundry.
   
       For example:
       <pre class="terminal">$ bosh -e my-env -d cf deploy cf.yml -v deployment-vars.yml \
  
positive.code: owner: Diego Persistence
  ---
  
  This topic describes how Cloud Foundry (CF) operators can deploy volume services.
  
  
  ## <a id="overview"></a> Overview
  
  A volume service gives apps access to a remote filesystem, such as NFS.
  To provide a volume service for CF developers to use with their apps,
  you must deploy a driver and broker pair.
  
  For current versions of CF that have been been deployed with cf-deployment,
  you can deploy brokers and drivers using ops files.
  For an example, see [Example: Deploy NFS Volume Service to CF](#example) and
  [Example 2: Deploy SMB Volume Service to CF](#smb-example) below.
  
  ### <a id='additional-info'></a> Additional Information
  
  For more information about volume services and the drivers and brokers available to CF, see the following:
  
  * [Volume Services Google Doc](https://docs.google.com/document/d/1YtPMY9EjxlgJPa4SVVwIinfid_fshCF48xRhzyoZhrQ/edit?usp=sharing)
  * [Volume Services Troubleshooting Guide](https://github.com/cloudfoundry/volman/blob/master/TROUBLESHOOTING.md)
  
negative.code:   For example:
    <pre class="terminal">$ bosh -e my-env -d cf run-errand nfsbrokerpush</pre>
  
  Your Cloud Foundry deployment now has a running service broker and volume drivers 
  and is ready to mount NFS volumes.
  
  ### <a id="broker"></a> Grant Access to the NFS Service
  
  For Cloud Foundry app developers to use the NFS broker, you must grant app developers access
  to the NFS service.
  
  To grant access to the NFS service, do the following:
  
  1. Run the following command:
  
      ```
      cf enable-service-access nfs
      ```
  
  Cloud Foundry app developers can now create an NFS service and bind instances to their apps.
  For more information, see
  [Using an External File System (Volume Services)](../devguide/services/using-vol-services.html).
  
  ### <a id="ldap"></a> (Optional) Enable LDAP Support
  
  For better NFS security, you can configure your Cloud Foundry deployment to connect to an external LDAP server.
  When you connect your deployment to an LDAP server, the NFS volume service is secured
  so that an app developer cannot bind
  to an NFS share using an arbitrary UID.
  This ensures that an app developer cannot gain access to
  sensitive data stored by another user or app.
  
  Configuring an LDAP server enables the NFS volume driver to do the following:
  
  - Validate app developer credentials for user accounts.
  - Translate user credentials into a valid UID and GID for that user.
  
  When you enable LDAP support, regular UID and GID parameters are disabled. If you enable LDAP,
  app developers need to provide valid credentials
  for any user they want to use on the NFS server.
  
  To enable LDAP support, do the following:
  
  1. [Configure your LDAP Server](#ldap-config)
  1. [Configure your Cloud Foundry Deployment](#cf-ldap-config)
  
  #### <a name="ldap-config"></a>Configure your LDAP Server
  
  If you want to integrate LDAP, your LDAP server must be configured to connect to a Cloud Foundry deployment.
   
  To integrate LDAP with your Cloud Foundry deployment, do the following:
  
  1. Configure your external LDAP server to have the following:
      - A provisioned service account that has read-only access to user records. This account
      is used by nfsv3driver to look up usernames and convert them to UIDs.<br>
      In Windows Server 2008 and later, you can do this by creating a new user
        and adding it to the `Read-only Domain Controllers` group.
      - A LDAP schema that contains `uidNumber` and `gidNumber` fields for the user accounts
      used by NFS services. These fields are used to establish the correct UID for a named user.
      - Be reachable through the network from the Diego cell VMs
      on the port you use to connect to your deployment. This port is usually `389` or `636`.
  
  #### <a name="cf-ldap-config"></a>Configure your Cloud Foundry Deployment
  
  If you want to integrate LDAP, your Cloud Foundry deployment must redeployed with the `enable-nfs-ldap.yml` ops file
  and your LDAP server information. 
  To view the NFS LDAP ops file,
  see [cf-deployment](https://github.com/cloudfoundry/cf-deployment/blob/master/operations/enable-nfs-ldap.yml)
  in GitHub.
   
  To integrate LDAP with your Cloud Foundry deployment, do the following:
  
  1. Provide the following variables in a variables file or with the `-v` flag on the BOSH command line:
  
      <table>
        <tr>
          <th width=35%>Variable</th>
          <th>Description</th>
        </tr>
  
        <tr>
          <td><code>nfs-ldap-service-user</code></td>
          <td>This is your LDAP service account user name.</td>
        </tr>
  
        <tr>
          <td><code>nfs-ldap-service-password</code></td>
          <td>This is your LDAP service account password.</td>
        </tr>
  
        <tr>
          <td><code>nfs-ldap-host</code></td>
          <td>This is the LDAP server host name or IP address.</td>
        </tr>
  
        <tr>
          <td><code>nfs-ldap-port</code></td>
          <td>This is the LDAP server port.</td>
        </tr>
  
        <tr>
          <td><code>nfs-ldap-proto</code></td>
          <td>This is the LDAP server protocol. The protocol is either TCP or UDP.</td>
        </tr>
  
        <tr>
          <td><code>nfs-ldap-fqdn</code></td>
          <td>This is the LDAP fully qualified domain name for user records.
            This domain name is searched against when user UIDs are looked up.</td>
        </tr>
  
      </table>
  
  1. Redeploy your cf-deployment with the `enable-nfs-ldap.yml` ops file by running the following command:
  
      ```
      bosh -e MY-ENV -d MY-DEPLOYMENT deploy MANIFEST-YAML -v VARIABLES-YAML \
    		-o operations/enable-nfs-ldap.yml
      ```
  
      Where:
      + `MY-ENV` is the name of the BOSH Director.
      + `MY-DEPLOYMENT` is the name of your deployment.
      + `MANIFEST-YAML` is the name of the manifest YAML file you used when you deployed Cloud Foundry.
      + `VARIABLES-YAML` is the name of the variables YAML file for the LDAP information.
  
      For example:
      <pre class="terminal">$ bosh -e my-env -d cf deploy cf.yml -v ldap-vars.yml \
  		-o operations/enable-nfs-ldap.yml</pre>
  
  
  ### <a id="server"></a> (Optional) Deploy Test Servers
  
  