anchor.diff:  
   To install grafana we need to run:
   
  -```
  -$ kubectl apply -f templates/prometheus/grafana-bundle.yaml
  -secret "grafana-credentials" created
  -service "grafana" created
  -configmap "grafana-dashboards-0" created
  -deployment "grafana" created
  -```
  +  $ kubectl apply -f templates/prometheus/grafana-bundle.yaml
  +  secret "grafana-credentials" created
  +  service "grafana" created
  +  configmap "grafana-dashboards-0" created
  +  deployment "grafana" created
   
   Lets wait for grafana to come up:
   
  -```
  -$ kubectl rollout status deployment/grafana -n monitoring
  -...
  -deployment "grafana" successfully rolled out
  -```
  +  $ kubectl rollout status deployment/grafana -n monitoring
  +  ...
  +  deployment "grafana" successfully rolled out
   
   === Grafana Dashboard
   
   Lets forward the grafana dashboard to a local port:
   
  -```
  -$ kubectl port-forward $(kubectl get pod -l app=grafana -o jsonpath={.items[0].metadata.name} -n monitoring) 3000 -n monitoring
  -Forwarding from 127.0.0.1:3000 -> 3000
  -```
  +  $ kubectl port-forward $(kubectl get pod -l app=grafana -o jsonpath={.items[0].metadata.name} -n monitoring) 3000 -n monitoring
  +  Forwarding from 127.0.0.1:3000 -> 3000
   
   Grafana dashboard is now accessible at http://localhost:3000/.
   
  
positive.code: 
  First we need to deploy the Prometheus Operator which will listen for the new Custom Resources:
  
  ```
  $ kubectl apply -f templates/prometheus/prometheus-bundle.yaml
  namespace "monitoring" created
  clusterrolebinding "prometheus-operator" created
  clusterrole "prometheus-operator" created
  serviceaccount "prometheus-operator" created
  deployment "prometheus-operator" created
  ```
  
  Next we need to wait until the Prometheus Operator has started:
  ```
  $ kubectl rollout status deployment/prometheus-operator -n monitoring
  ...
  deployment "prometheus-operator" successfully rolled out
  ```
  
  As a final step we need to deploy the Prometheus Custom Resource, Service Monitors, Cluster Roles and Bindings (RBAC):
  
  ```
  $ kubectl apply -f templates/prometheus/prometheus.yaml
  serviceaccount "kube-state-metrics" created
  clusterrole "kube-state-metrics" created
  clusterrolebinding "kube-state-metrics" created
  service "kube-scheduler-prometheus-discovery" created
  service "kube-controller-manager-prometheus-discovery" created
  daemonset "node-exporter" created
  service "node-exporter" created
  deployment "kube-state-metrics" created
  service "kube-state-metrics" created
  prometheus "prometheus" created
  servicemonitor "prometheus-operator" created
  servicemonitor "kube-apiserver" created
  servicemonitor "kubelet" created
  servicemonitor "kube-controller-manager" created
  servicemonitor "kube-scheduler" created
  servicemonitor "kube-state-metrics" created
  servicemonitor "node-exporter" created
  alertmanager "main" created
  secret "alertmanager-main" created
  ```
  
  Lets wait for prometheus to come up:
  
  ```
  $ kubectl get po -l prometheus=prometheus -n monitoring
  NAME                      READY     STATUS    RESTARTS   AGE
  prometheus-prometheus-0   2/2       Running   0          1m
  prometheus-prometheus-1   2/2       Running   0          1m
  ```
  
  === Prometheus Dashboard
  
  Prometheus is now scraping metrics from the different scraping targets and we forward the dashboard via:
  
  ```
  $ kubectl port-forward $(kubectl get po -l prometheus=prometheus -n monitoring -o jsonpath={.items[0].metadata.name}) 9090 -n monitoring
  Forwarding from 127.0.0.1:9090 -> 9090
  ```
  
  Now open the browser at http://localhost:9090/targets and all targets should be shown as `UP` (it might take a couple of minutes until data collectors are up and running for the first time).
  
  
negative.code: 
  It shows the output as:
  
    NAME                                     TYPE                                  DATA      AGE
    attachdetach-controller-token-dhkcr      kubernetes.io/service-account-token   3         3h
    certificate-controller-token-p131b       kubernetes.io/service-account-token   3         3h
    daemon-set-controller-token-r4mmp        kubernetes.io/service-account-token   3         3h
    default-token-7vh0x                      kubernetes.io/service-account-token   3         3h
    deployment-controller-token-jlzkj        kubernetes.io/service-account-token   3         3h
    disruption-controller-token-qrx2v        kubernetes.io/service-account-token   3         3h
    dns-controller-token-v49b6               kubernetes.io/service-account-token   3         3h
    endpoint-controller-token-hgkbm          kubernetes.io/service-account-token   3         3h
    generic-garbage-collector-token-34fvc    kubernetes.io/service-account-token   3         3h
    horizontal-pod-autoscaler-token-lhbkf    kubernetes.io/service-account-token   3         3h
    job-controller-token-c2s8j               kubernetes.io/service-account-token   3         3h
    kube-dns-autoscaler-token-s3svx          kubernetes.io/service-account-token   3         3h
    kube-dns-token-92xzb                     kubernetes.io/service-account-token   3         3h
    kube-proxy-token-0ww14                   kubernetes.io/service-account-token   3         3h
    kubernetes-dashboard-certs               Opaque                                2         9m
    kubernetes-dashboard-key-holder          Opaque                                2         9m
    kubernetes-dashboard-token-vt0fd         kubernetes.io/service-account-token   3         10m
    namespace-controller-token-423gh         kubernetes.io/service-account-token   3         3h
    node-controller-token-r6lsr              kubernetes.io/service-account-token   3         3h
    persistent-volume-binder-token-xv30g     kubernetes.io/service-account-token   3         3h
    pod-garbage-collector-token-fwmv4        kubernetes.io/service-account-token   3         3h
    replicaset-controller-token-0cg8r        kubernetes.io/service-account-token   3         3h
    replication-controller-token-3fwxd       kubernetes.io/service-account-token   3         3h
    resourcequota-controller-token-6rl9f     kubernetes.io/service-account-token   3         3h
    route-controller-token-9brzb             kubernetes.io/service-account-token   3         3h
    service-account-controller-token-bqlsk   kubernetes.io/service-account-token   3         3h
    service-controller-token-1qlg6           kubernetes.io/service-account-token   3         3h
    statefulset-controller-token-kmgzg       kubernetes.io/service-account-token   3         3h
    ttl-controller-token-vbnhf               kubernetes.io/service-account-token   3         3h
  
  We can login using any secret with type 'kubernetes.io/service-account-token', though each of them have different privileges. In our case, we'll use the token from secret `default-token-7vh0x` to login. Use the following command to get the token for this secret:
  
  