anchor.diff:  
   Configuration for identity providers has changed for {product-title} 4, including the following notable changes:
   
  -* The request header identity provider in {product-title} 4.5 requires mutual TLS, where in {product-title} 3.11 it did not.
  -* The configuration of the OpenID Connect identity provider was simplified in {product-title} 4.5. It now obtains data, which previously had to specified in {product-title} 3.11, from the provider's `/.well-known/openid-configuration` endpoint.
  +* The request header identity provider in {product-title} 4.6 requires mutual TLS, where in {product-title} 3.11 it did not.
  +* The configuration of the OpenID Connect identity provider was simplified in {product-title} 4.6. It now obtains data, which previously had to specified in {product-title} 3.11, from the provider's `/.well-known/openid-configuration` endpoint.
   
   For more information, see xref:../../authentication/understanding-identity-provider.adoc#understanding-identity-provider[Understanding identity provider configuration].
   
   [id="migration-preparing-monitoring"]
   === Monitoring considerations
   
  -Review the following monitoring changes to consider when transitioning from {product-title} 3.11 to {product-title} 4.5.
  +Review the following monitoring changes to consider when transitioning from {product-title} 3.11 to {product-title} 4.6.
   
   [discrete]
   ==== Alert for monitoring infrastructure availability
  
positive.code: [id="migration-preparing-storage"]
  === Storage considerations
  
  Review the following storage changes to consider when transitioning from {product-title} 3.11 to {product-title} 4.5.
  
  [discrete]
  ==== Local volume persistent storage
  
  Local storage is only supported by using the Local Storage Operator in {product-title} 4.5. It is not supported to use the local provisioner method from {product-title} 3.11.
  
  For more information, see xref:../../storage/persistent_storage/persistent-storage-local.adoc#persistent-storage-using-local-volume[Persistent storage using local volumes].
  
  [discrete]
  ==== FlexVolume persistent storage
  
  The FlexVolume plug-in location changed from {product-title} 3.11. The new location in {product-title} 4.5 is `/etc/kubernetes/kubelet-plugins/volume/exec`. Attachable FlexVolume plug-ins are no longer supported.
  
  For more information, see xref:../../storage/persistent_storage/persistent-storage-flexvolume.adoc#persistent-storage-using-flexvolume[Persistent storage using FlexVolume].
  
  [discrete]
  ==== Container Storage Interface (CSI) persistent storage
  
  Persistent storage using the Container Storage Interface (CSI) was link:https://access.redhat.com/support/offerings/techpreview[Technology Preview] in {product-title} 3.11. CSI version 1.1.0 is fully supported in {product-title} 4.5, but does not ship with any CSI drivers. You must install your own driver.
  
  For more information, see xref:../../storage/container_storage_interface/persistent-storage-csi.adoc#persistent-storage-using-csi[Persistent storage using the Container Storage Interface (CSI)].
  
  
negative.code: [id="migration-preparing-security"]
  === Security considerations
  
  Review the following security changes to consider when transitioning from {product-title} 3.11 to {product-title} 4.6.
  
  [discrete]
  ==== Unauthenticated access to discovery endpoints
  
  In {product-title} 3.11, an unauthenticated user could access the discovery endpoints (for example, [x-]`/api/*` and [x-]`/apis/*`). For security reasons, unauthenticated access to the discovery endpoints is no longer allowed in {product-title} 4.6. If you do need to allow unauthenticated access, you can configure the RBAC settings as necessary; however, be sure to consider the security implications as this can expose internal cluster components to the external network.
  
  // TODO: Anything to xref to, or additional details?
  
  