anchor.diff:  
     $ kubectl get secrets default-token-kvjn9 -o jsonpath="{.data['ca\.crt']}" | base64 -D > ~/.kube/kops.crt
   
  -.. Copy the certificate to EC2 instance where Vault is running:
  -
  -  $ scp -i ~/.ssh/arun-us-east1.pem ~/.kube/kops.crt ec2-user@ec2-54-237-223-40.compute-1.amazonaws.com:~/kops.crt
  -kops.crt                                                                                    100% 1046    11.1KB/s   00:00   
  -
   . Now that all the required values are available, configure the Kubernetes auth backend
  -.. In the EC2 instance, mount the Kubernetes auth backend:
  -
  -  [ec2-user@ip-172-31-26-180 ~]$ ./vault auth-enable kubernetes
  +.. Mount the Kubernetes auth backend:
  +
  +  $ vault auth-enable kubernetes
     Successfully enabled 'kubernetes' at 'kubernetes'!
   
   .. Configure the auth backend:
   
  -  vault write auth/kubernetes/config \
  +  $ vault write auth/kubernetes/config \
       token_reviewer_jwt=<service-account-token>  \
       kubernetes_host=<api-server> \
  -    kubernetes_ca_cert=~/kops.crt
  +    kubernetes_ca_cert=@~/.kube/kops.crt
   +
   For example, here is how our command will look like:
   
  -  [ec2-user@ip-172-31-26-180 ~]$ ./vault write auth/kubernetes/config \
  +  $ vault write auth/kubernetes/config \
       token_reviewer_jwt=eyJ . . . reg  \
       kubernetes_host=https://api-example-cluster-k8s-l-1dt7vk-41321592.us-east-1.elb.amazonaws.com \
  -    kubernetes_ca_cert=~/kops.crt
  +    kubernetes_ca_cert=@~/.kube/kops.crt
     Success! Data written to: auth/kubernetes/config
  -+
  +
   . Create a role with service account name `vault-auth` in the `default` namespace:
   
  -  [ec2-user@ip-172-31-26-180 ~]$ ./vault write auth/kubernetes/role/demo \
  +  $ vault write auth/kubernetes/role/demo \
       bound_service_account_names=vault-auth \
       bound_service_account_namespaces=default \
       policies=kube-auth \
  
positive.code:   ttl                               0
  
  . Create a policy for this role
  .. Copy the policy file to EC2 instance:
  
    scp -i ~/.ssh/arun-us-east1.pem templates/kube-auth.hcl ec2-user@ec2-54-237-223-40.compute-1.amazonaws.com:~/kube-auth.hcl
    kube-auth.hcl                                                                               100%   49     0.5KB/s   00:00    
  
  .. Create the policy for this role:
  
    [ec2-user@ip-172-31-26-180 ~]$ ./vault policy-write kube-auth kube-auth.hcl
    Policy 'kube-auth' written.
  
  . Write secrets to Vault:
  
    [ec2-user@ip-172-31-26-180 ~]$ ./vault write secret/creds GREETING=Hello NAME=World
    Success! Data written to: secret/creds
  
  . Check that this value can be read:
  
    [ec2-user@ip-172-31-26-180 ~]$ ./vault read -field=GREETING secret/creds
    Hello
  +
  This can also be verified by downloading the Vault CLI on your local machine:
  +
  ```
  $ export VAULT_ADDR='http://http://ec2-54-237-223-40.compute-1.amazonaws.com:8200'
  $ vault auth
  Token (will be hidden):
  $ vault read -field=GREETING secret/creds
  Hello
  ```
  +
  The value of token is printed during server startup. It is also stored in the file `~/.vault-token` where the server was started.
  
  === Deploy a Pod using secrets from Vault
  
  Let's deploy a Pod that is reading secrets from the Vault server.
  
  . The configuration file looks like:
  
    apiVersion: v1
    kind: Pod
    metadata:
      name: java-app-secrets
    spec:
      containers:
      - name: java-app-secrets
        image: arungupta/java-app-secrets:latest
        env:
          - name: VAULT_ADDR
            value: http://ec2-54-237-223-40.compute-1.amazonaws.com:8200
          - name: VAULT_TOKEN
            value: 4e93b3c6-c459-f166-e7e9-6c48044cfdb6
      restartPolicy: Never
  
  . Deploy the Pod:
  
    $ kubectl apply -f templates/pod-vault.yaml 
    pod "java-app-secrets" created
  
  . Get the list of Pods:
  
    $ kubectl get pods --show-all
    NAME               READY     STATUS      RESTARTS   AGE
    java-app-secrets   0/1       Completed   0          20s
  
  . Get logs from the complete Pod:
  
    $ kubectl logs java-app-secrets
    Connecting to Vault: http://ec2-54-237-223-40.compute-1.amazonaws.com:8200
    vault: HelloWorld
  
  
negative.code: +
  . Note down the private IP address of the EC2 console. This is needed to start our Vault server.
  
  === Start Vault Server on EC2
  
  . Download Vault server:
  
    wget https://releases.hashicorp.com/vault/0.9.0/vault_0.9.0_linux_amd64.zip
  
  . Unzip Vault: `unzip vault_0.9.0_linux_amd64.zip`
  . Start Vault server:
  +
  