anchor.diff:                mountPath: /certs
                 name: opa-ca
             env:
  +            - name: MY_POD_NAME
  +              valueFrom:
  +                fieldRef:
  +                  fieldPath: metadata.name
               - name: MY_POD_NAMESPACE
                 valueFrom:
                   fieldRef:
  
positive.code: basicConstraints = CA:FALSE
  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  extendedKeyUsage = clientAuth, serverAuth
  subjectAltName = @alt_names
  [alt_names]
  DNS.1 = opa.opa.cluster.svc.local
  ```
  
  *server.conf*
  ```bash
  [req]
  req_extensions = v3_req
  distinguished_name = req_distinguished_name
  [req_distinguished_name]
  [ v3_req ]
  basicConstraints = CA:FALSE
  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  extendedKeyUsage = clientAuth, serverAuth
  subjectAltName = @alt_names
  [alt_names]
  DNS.1 = opa.opa.cluster.svc.local
  ```
  
  IMPORTANT: The subjectAltName/IP address in the certificate MUST match the one configured on the Kubernetes Service.
  
  Now create local files that contain the CA and client/server key pairs.  Shortly we will
  hand these keys to OPA and the API server so they can communicate.
  
  Create a certificate authority:
  
  
negative.code: openssl req -x509 -new -nodes -key ca.key -days 100000 -out ca.crt -subj "/CN=admission_ca"
  ```
  
  Create a server certiticate.
  IMPORTANT: the CN must match the name of the service used to expose the external admission controller.
  
  ```bash
  openssl genrsa -out server.key 2048
  ```
  
  ```bash
  openssl req -new -key server.key -out server.csr -subj "/CN=opa.opa.svc" -config server.conf
  ```
  
  ```bash
  openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 100000 -extensions v3_req -extfile server.conf
  ```
  
  === 2.2: Deploy OPA on Kubernetes
  
  