anchor.diff:  
   When running the following command again in shell 2, we should see it eventually timeout and fail:
   
  -----
  -busybox shell>  wget -S http://http-echo.ns-1.svc.cluster.local/test --post-data '{"message":"hello"}'
  -----
  +  / # wget -S http://http-echo.ns-1.svc.cluster.local/test2 --post-data '{"message":"hello"}'
  +  Connecting to http-echo.ns-1.svc.cluster.local (100.64.161.56:80)
  +    HTTP/1.1 200 OK
  +    X-Powered-By: Express
  +    Content-Type: application/json; charset=utf-8
  +    Content-Length: 536
  +    ETag: W/"218-ejthHoYRVZ+oS3p9I5V2qGn/CbM"
  +    Date: Thu, 26 Oct 2017 02:12:57 GMT
  +    Connection: close
  +    
  +  test2                100% |*************************************************************************************************|   536   0:00:00 ETA
  +
  +TODO: Issue #
   
   === Create network policy with a rule
   
  -We will now delete the NetworkPolicy that we just created, and create a new NetworkPolicy with a rule defined.  If you `cat `allow-network-policy.yaml` you will see the following rule defined:
  -
  -----
  -spec:
  -  podSelector:
  -    matchLabels:
  -      app: http-echo
  -  ingress:
  -    - from:
  -      - podSelector:
  -          matchLabels:
  -            app: busybox
  -----
  +We will now delete the NetworkPolicy that we just created, and create a new NetworkPolicy with a rule defined.  If you `cat templates/allow-network-policy.yaml` you will see the following rule defined:
  +
  +  spec:
  +    podSelector:
  +      matchLabels:
  +        app: http-echo
  +    ingress:
  +      - from:
  +        - podSelector:
  +            matchLabels:
  +              app: busybox
   
   The rule above is stating that for every pod that has the label `app: http-echo` defined, allow access to it from pods that have the label `app: busybox` defined.
   
   Run the following to remove the deny all by default rule, and replace with the above allow rule:
   
  -----
  -kubectl delete netpol deny-all-by-default --namespace=ns-1
  -kubectl create -f allow-network-policy.yaml --namespace=ns-1
  -----
  +  $ kubectl delete netpol deny-all-by-default --namespace=ns-1
  +  networkpolicy "deny-all-by-default" deleted
  +  calico $ kubectl create -f templates/allow-network-policy.yaml --namespace=ns-1
  +  networkpolicy "allow" created
   
   If we repeat the following command in shell 2, the call should still timeout and fail:
   
  -----
  -busybox shell>  wget -S http://http-echo.ns-1.svc.cluster.local/test --post-data '{"message":"hello"}'
  -----
  +  / # wget -S http://http-echo.ns-1.svc.cluster.local/test3 --post-data '{"message":"hello"}'
  +  Connecting to http-echo.ns-1.svc.cluster.local (100.64.161.56:80)
  +    HTTP/1.1 200 OK
  +    X-Powered-By: Express
  +    Content-Type: application/json; charset=utf-8
  +    Content-Length: 536
  +    ETag: W/"218-m6+Oqv9DaX+AbeOmSAHlBRCHy04"
  +    Date: Thu, 26 Oct 2017 02:14:54 GMT
  +    Connection: close
  +    
  +  test3                100% |*************************************************************************************************|   536   0:00:00 ETA
  +
  +TODO: Issue #
   
   Why is this still failing even after creating a rule?  It is failing because we configured the rule so that only pods with the label `app: busybox` are authorized to call pods with the label `app: http-echo`.  Let's go ahead and label our `busybox` pod:
   
  -----
  -kubectl label po --selector=run=busybox --namespace=ns-1 app=busybox
  -----
  +  kubectl label po --selector=run=busybox --namespace=ns-1 app=busybox
   
   Repeating the test in shell 2 again should now be successful:
   
  -----
  -busybox shell>  wget -S http://http-echo.ns-1.svc.cluster.local/test --post-data '{"message":"hello"}'
  -----
  +  / # wget -S http://http-echo.ns-1.svc.cluster.local/test4 --post-data '{"message":"hello"}'
  +  Connecting to http-echo.ns-1.svc.cluster.local (100.64.161.56:80)
  +    HTTP/1.1 200 OK
  +    X-Powered-By: Express
  +    Content-Type: application/json; charset=utf-8
  +    Content-Length: 536
  +    ETag: W/"218-xgvU8WZSN+2SEyOX6Q2R/AhLuRM"
  +    Date: Thu, 26 Oct 2017 02:15:32 GMT
  +    Connection: close
  +    
  +  test4                100% |*************************************************************************************************|   536   0:00:00 ETA
   
   == Teardown
   
  -----
  -kubectl delete ns ns-1
  -----
  -
  +Remove all the resources and the namespace using the command:
  +
  +  kubectl delete ns ns-1
   
   == Advanced Topics
   
  
positive.code: It shows the output:
  
  ```
  $ kops update cluster cluster.k8s.local --yes
  I1025 15:56:26.679683    3458 apply_cluster.go:420] Gossip DNS: skipping DNS validation
  W1025 15:56:26.701541    3458 firewall.go:202] Opening etcd port on masters for access from the nodes, for calico.  This is unsafe in untrusted environments.
  I1025 15:56:27.214980    3458 executor.go:91] Tasks: 0 done / 72 total; 34 can run
  
negative.code:     Connection: close
      
    test                 100% |*************************************************************************************************|   533   0:00:00 ETA
  +
  HTTP POST request succeeds.
  
  === Create default network policy
  
  