anchor.diff:  is not specified, OpenShift will perform the following logic for retrieving the
   image:
   
  -1. If the image's tag is `latest`, OpenShift will always pull down the image from its registry
  -2. If the image's tag is not `latest`, and the image exists on the node, OpenShift will run the existing image
  -3. If the image's tag is not `latest`, and the image does not exist on the node, OpenShift will pull down the image from its registry
  +1. If the image's tag is `latest`, OpenShift will always pull down the image from its registry.
  +2. If the image's tag is not `latest`, and the image exists on the node, OpenShift will run the existing image.
  +3. If the image's tag is not `latest`, and the image does not exist on the node, OpenShift will pull down the image from its registry.
   
   If the pull policy is set to `PullIfNotPresent`, OpenShift will pull the image
   if it doesn't exist on the node.
  
positive.code: }
  ----
  
  <1> Identity name must be in the form providerName:providerUserName.
  <2> The name of the identity provider.
  <3> The name that uniquely represents this identity in the scope of the identity provider.
  <4> The name of the user this identity maps to.
  <5> The UID of the user this identity maps to.
  ====
  
  === User
  
negative.code: }
  ----
  
  <1> The `name` is used as the `client_id` parameter in OAuth requests.
  <2> When `respondWithChallenges` is set to `true`, unauthenticated requests to
  `/oauth/authorize` will result in `WWW-Authenticate` challenges, if supported by
  the configured authentication methods.
  <3> The value in the `secret` parameter is used as the `client_secret` parameter
  in an authorization code flow.
  <4> One or more absolute URIs can be placed in the `redirectURIs` section. The
  `redirect_uri` parameter sent with authorization requests must be prefixed by
  one of the specified `redirectURIs`.
  ====
  
  === OAuthClientAuthorization
  