anchor.diff:  
   To install {product-title} 3.11, you prepared your {op-system-base-full} hosts, set all of the configuration values your cluster needed, and then ran an Ansible playbook to install and set up your cluster.
   
  -In {product-title} 4.5, you use the OpenShift installation program to create a minimum set of resources required for a cluster. Once the cluster is running, you use Operators to further configure your cluster and to install new services. After first boot, {op-system-first} systems are managed by the Machine Config Operator (MCO) that runs in the {product-title} cluster.
  +In {product-title} 4.6, you use the OpenShift installation program to create a minimum set of resources required for a cluster. Once the cluster is running, you use Operators to further configure your cluster and to install new services. After first boot, {op-system-first} systems are managed by the Machine Config Operator (MCO) that runs in the {product-title} cluster.
   
   For more information, see xref:../../architecture/architecture-installation.adoc#installation-process_architecture-installation[Installation process].
   
   ifndef::openshift-origin[]
  -If you want to add RHEL worker machines to your {product-title} 4.5 cluster, you use an Ansible playbook to join the RHEL worker machines after the cluster is running. For more information, see xref:../../machine_management/adding-rhel-compute.adoc#adding-rhel-compute[Adding RHEL compute machines to an {product-title} cluster].
  +If you want to add RHEL worker machines to your {product-title} 4.6 cluster, you use an Ansible playbook to join the RHEL worker machines after the cluster is running. For more information, see xref:../../machine_management/adding-rhel-compute.adoc#adding-rhel-compute[Adding RHEL compute machines to an {product-title} cluster].
   endif::[]
   
   [discrete]
  
positive.code: 
  Configuration for identity providers has changed for {product-title} 4, including the following notable changes:
  
  * The request header identity provider in {product-title} 4.5 requires mutual TLS, where in {product-title} 3.11 it did not.
  * The configuration of the OpenID Connect identity provider was simplified in {product-title} 4.5. It now obtains data, which previously had to specified in {product-title} 3.11, from the provider's `/.well-known/openid-configuration` endpoint.
  
  For more information, see xref:../../authentication/understanding-identity-provider.adoc#understanding-identity-provider[Understanding identity provider configuration].
  
  [id="migration-preparing-monitoring"]
  === Monitoring considerations
  
  Review the following monitoring changes to consider when transitioning from {product-title} 3.11 to {product-title} 4.5.
  
  [discrete]
  ==== Alert for monitoring infrastructure availability
  
negative.code: [id="migration-preparing-security"]
  === Security considerations
  
  Review the following security changes to consider when transitioning from {product-title} 3.11 to {product-title} 4.6.
  
  [discrete]
  ==== Unauthenticated access to discovery endpoints
  
  In {product-title} 3.11, an unauthenticated user could access the discovery endpoints (for example, [x-]`/api/*` and [x-]`/apis/*`). For security reasons, unauthenticated access to the discovery endpoints is no longer allowed in {product-title} 4.6. If you do need to allow unauthenticated access, you can configure the RBAC settings as necessary; however, be sure to consider the security implications as this can expose internal cluster components to the external network.
  
  // TODO: Anything to xref to, or additional details?
  
  