anchor.diff:  directory; we will only use them once to generate certificates.  You may discard
   them after running the `openssl` commands below.
   
  -*client.conf*
  +*server.conf*
   ```bash
   [req]
   req_extensions = v3_req
  
positive.code: basicConstraints = CA:FALSE
  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  extendedKeyUsage = clientAuth, serverAuth
  subjectAltName = @alt_names
  [alt_names]
  DNS.1 = opa.opa.cluster.svc.local
  ```
  
  *server.conf*
  ```bash
  [req]
  req_extensions = v3_req
  distinguished_name = req_distinguished_name
  [req_distinguished_name]
  [ v3_req ]
  basicConstraints = CA:FALSE
  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  extendedKeyUsage = clientAuth, serverAuth
  subjectAltName = @alt_names
  [alt_names]
  DNS.1 = opa.opa.cluster.svc.local
  ```
  
  IMPORTANT: The subjectAltName/IP address in the certificate MUST match the one configured on the Kubernetes Service.
  
  Now create local files that contain the CA and client/server key pairs.  Shortly we will
  hand these keys to OPA and the API server so they can communicate.
  
  Create a certificate authority:
  
  
negative.code:               mountPath: /certs
                name: opa-server
          - name: kube-mgmt
            image: openpolicyagent/kube-mgmt:0.5
            args:
              - "--replicate=v1/pods"
              - "--pod-name=$(MY_POD_NAME)"
              - "--pod-namespace=$(MY_POD_NAMESPACE)"
              - "--register-admission-controller"
              - "--admission-controller-ca-cert-file=/certs/ca.crt"
              - "--admission-controller-service-name=opa"
  