anchor.diff:  basicConstraints = CA:FALSE
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   extendedKeyUsage = clientAuth, serverAuth
  -subjectAltName = @alt_names
  -[alt_names]
  -DNS.1 = opa.opa.cluster.svc.local
  -```
  -
  -*server.conf*
  -```bash
  -[req]
  -req_extensions = v3_req
  -distinguished_name = req_distinguished_name
  -[req_distinguished_name]
  -[ v3_req ]
  -basicConstraints = CA:FALSE
  -keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  -extendedKeyUsage = clientAuth, serverAuth
  -subjectAltName = @alt_names
  -[alt_names]
  -DNS.1 = opa.opa.cluster.svc.local
  -```
  -
  -IMPORTANT: The subjectAltName/IP address in the certificate MUST match the one configured on the Kubernetes Service.
  -
  -Now create local files that contain the CA and client/server key pairs.  Shortly we will
  -hand these keys to OPA and the API server so they can communicate.
  +```
  +
  +Now create local files that contain the CA and server key pair.
   
   Create a certificate authority:
   
  
positive.code:               mountPath: /certs
                name: opa-server
          - name: kube-mgmt
            image: openpolicyagent/kube-mgmt:0.4
            args:
              - "--replicate=v1/pods"
              - "--register-admission-controller"
              - "--admission-controller-ca-cert-file=/certs/ca.crt"
              - "--admission-controller-service-name=opa"
  
negative.code: directory; we will only use them once to generate certificates.  You may discard
  them after running the `openssl` commands below.
  
  *server.conf*
  ```bash
  [req]
  req_extensions = v3_req
  