anchor.diff:                mountPath: /certs
                 name: opa-server
           - name: kube-mgmt
  -          image: openpolicyagent/kube-mgmt:0.4
  +          image: openpolicyagent/kube-mgmt:0.5
             args:
               - "--replicate=v1/pods"
  +            - "--pod-name=$(MY_POD_NAME)"
  +            - "--pod-namespace=$(MY_POD_NAMESPACE)"
               - "--register-admission-controller"
               - "--admission-controller-ca-cert-file=/certs/ca.crt"
               - "--admission-controller-service-name=opa"
  
positive.code:               mountPath: /certs
                name: opa-ca
            env:
              - name: MY_POD_NAMESPACE
                valueFrom:
                  fieldRef:
  
negative.code: openssl req -x509 -new -nodes -key ca.key -days 100000 -out ca.crt -subj "/CN=admission_ca"
  ```
  
  Create a server certiticate.
  IMPORTANT: the CN must match the name of the service used to expose the external admission controller.
  
  ```bash
  openssl genrsa -out server.key 2048
  ```
  
  ```bash
  openssl req -new -key server.key -out server.csr -subj "/CN=opa.opa.svc" -config server.conf
  ```
  
  ```bash
  openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 100000 -extensions v3_req -extfile server.conf
  ```
  
  === 2.2: Deploy OPA on Kubernetes
  
  