anchor.diff:  
   Configuration for identity providers has changed for {product-title} 4, including the following notable changes:
   
  -* The request header identity provider in {product-title} 4.4 requires mutual TLS, where in {product-title} 3.11 it did not.
  -* The configuration of the OpenID Connect identity provider was simplified in {product-title} 4.4. It now obtains data, which previously had to specified in {product-title} 3.11, from the provider's `/.well-known/openid-configuration` endpoint.
  +* The request header identity provider in {product-title} 4.5 requires mutual TLS, where in {product-title} 3.11 it did not.
  +* The configuration of the OpenID Connect identity provider was simplified in {product-title} 4.5. It now obtains data, which previously had to specified in {product-title} 3.11, from the provider's `/.well-known/openid-configuration` endpoint.
   
   For more information, see xref:../../authentication/understanding-identity-provider.adoc#understanding-identity-provider[Understanding identity provider configuration].
   
   [id="migration-preparing-monitoring"]
   === Monitoring considerations
   
  -Review the following monitoring changes to consider when transitioning from {product-title} 3.11 to {product-title} 4.4.
  +Review the following monitoring changes to consider when transitioning from {product-title} 3.11 to {product-title} 4.5.
   
   [discrete]
   ==== Alert for monitoring infrastructure availability
  
positive.code: 
  toc::[]
  
  Before performing your migration to {product-title} 4.4, it is important to take the time to properly plan for the transition. {product-title} 4 introduces architectural changes and enhancements, so the procedures that you used to manage your {product-title} 3 cluster might not apply for {product-title} 4.
  
  [NOTE]
  ====
  This planning document assumes that you are transitioning from {product-title} 3.11 to {product-title} 4.4.
  ====
  
  ifndef::openshift-origin[]
  
negative.code: [id="migration-preparing-security"]
  === Security considerations
  
  Review the following security changes to consider when transitioning from {product-title} 3.11 to {product-title} 4.5.
  
  [discrete]
  ==== Unauthenticated access to discovery endpoints
  
  In {product-title} 3.11, an unauthenticated user could access the discovery endpoints (for example, [x-]`/api/*` and [x-]`/apis/*`). For security reasons, unauthenticated access to the discovery endpoints is no longer allowed in {product-title} 4.5. If you do need to allow unauthenticated access, you can configure the RBAC settings as necessary; however, be sure to consider the security implications as this can expose internal cluster components to the external network.
  
  // TODO: Anything to xref to, or additional details?
  
  