anchor.diff:  +
   . Note down the private IP address of the EC2 console. This is needed to start our Vault server.
   
  -=== Start Vault Server
  -
  -. In EC2 instance, download Vault server:
  -+
  -```
  -wget https://releases.hashicorp.com/vault/0.9.0/vault_0.9.0_linux_amd64.zip
  -```
  -+
  +=== Start Vault Server on EC2
  +
  +. Download Vault server:
  +
  +  wget https://releases.hashicorp.com/vault/0.9.0/vault_0.9.0_linux_amd64.zip
  +
   . Unzip Vault: `unzip vault_0.9.0_linux_amd64.zip`
   . Start Vault server:
   +
  
positive.code: 
    $ kubectl get secrets default-token-kvjn9 -o jsonpath="{.data['ca\.crt']}" | base64 -D > ~/.kube/kops.crt
  
  .. Copy the certificate to EC2 instance where Vault is running:
  
    $ scp -i ~/.ssh/arun-us-east1.pem ~/.kube/kops.crt ec2-user@ec2-54-237-223-40.compute-1.amazonaws.com:~/kops.crt
  kops.crt                                                                                    100% 1046    11.1KB/s   00:00   
  
  . Now that all the required values are available, configure the Kubernetes auth backend
  .. In the EC2 instance, mount the Kubernetes auth backend:
  
    [ec2-user@ip-172-31-26-180 ~]$ ./vault auth-enable kubernetes
    Successfully enabled 'kubernetes' at 'kubernetes'!
  
  .. Configure the auth backend:
  
    vault write auth/kubernetes/config \
      token_reviewer_jwt=<service-account-token>  \
      kubernetes_host=<api-server> \
      kubernetes_ca_cert=~/kops.crt
  +
  For example, here is how our command will look like:
  
    [ec2-user@ip-172-31-26-180 ~]$ ./vault write auth/kubernetes/config \
      token_reviewer_jwt=eyJ . . . reg  \
      kubernetes_host=https://api-example-cluster-k8s-l-1dt7vk-41321592.us-east-1.elb.amazonaws.com \
      kubernetes_ca_cert=~/kops.crt
    Success! Data written to: auth/kubernetes/config
  +
  . Create a role with service account name `vault-auth` in the `default` namespace:
  
    [ec2-user@ip-172-31-26-180 ~]$ ./vault write auth/kubernetes/role/demo \
      bound_service_account_names=vault-auth \
      bound_service_account_namespaces=default \
      policies=kube-auth \
  
negative.code: High-Availability Enabled: false
  ```
  
  === Configure Vault CLI on your local machine
  
  . Download Vault server:
  
    wget https://releases.hashicorp.com/vault/0.9.0/vault_0.9.0_linux_amd64.zip
  
  . Unzip Vault: `unzip vault_0.9.0_linux_amd64.zip`
  
  . Find public IP address of the EC2 instance and setup an environment variable:
  
    export VAULT_ADDR='<public-ip-address>'
  +
  For example, this command will look like:
  +  
    export VAULT_ADDR='http://http://ec2-54-237-223-40.compute-1.amazonaws.com:8200'
  +
  . Verify the status can be seen from your local machine:
  +
  ```
  $ vault status
  Type: shamir
  Sealed: false
  Key Shares: 1
  Key Threshold: 1
  Unseal Progress: 0
  Unseal Nonce: 
  Version: 0.9.0
  Cluster Name: vault-cluster-01043c83
  Cluster ID: 89ccbeb4-8af1-7dca-77bb-38f39c423a39
  
  High-Availability Enabled: false
  ```
  
  === Configure Kubernetes Service Account
  
  . Create the service account to verify service account token during login:
  