anchor.diff:  <11> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
   endif::openshift-origin[]
   ifndef::restricted[]
  -ifdef::ibm-z,ibm-z-kvm[]
  -<12> The pullSecret value contains the authentication information for your registry. For `<bastion_host_name>`, specify the registry domain name that you specified in the certificate for your mirror registry, and for `<credentials>`, specify the base64-encoded user name and password for your mirror registry.
  -endif::ibm-z,ibm-z-kvm[]
  -ifndef::ibm-z,ibm-z-kvm[]
   <12> The pull secret that you obtained from the
   link:https://cloud.redhat.com/openshift/install/pull-secret[Pull Secret] page on the {cloud-redhat-com} site.
  -endif::ibm-z,ibm-z-kvm[]
   This pull secret allows you to authenticate with the services that are
   provided by the included authorities, including Quay.io, which serves the
   container images for {product-title} components.
  
positive.code:   -----END CERTIFICATE-----
  imageContentSources: <15>
  - mirrors:
    - <local_registry>/<local_repository_name>/release
    source: quay.io/openshift-release-dev/ocp-release
  - mirrors:
    - <local_registry>/<local_repository_name>/release
    source: registry.svc.ci.openshift.org/ocp/release
  endif::openshift-origin[]
  ifdef::openshift-origin[]
  additionalTrustBundle: | <13>
  
negative.code: endif::openshift-origin[]
  ifndef::restricted[]
  ifndef::openshift-origin[]
  pullSecret: '{"auths": ...}' <12>
  endif::openshift-origin[]
  ifdef::openshift-origin[]
  pullSecret: '{"auths": ...}' <11>
  