anchor.diff:  
   Alternatively, you can create a new cluster and use kops CLI options to specify the networking mode as shown below:
   
  +  export KOPS_STATE_STORE=s3://prefix-example-com-state-store
     kops create cluster \
       --name cluster2.k8s.local \
       --master-count 1 \
  
positive.code:   Date: Thu, 26 Oct 2017 02:15:32 GMT
    Connection: close
    
  test4                100% |*************************************************************************************************|   536   0:00:00 ETA
  ```
  
  == Teardown
  
  Remove all the resources and the namespace using the command:
  
    kubectl delete ns ns-1
  
  == Advanced Topics
  
  
negative.code: 
  The rule above is stating that for every pod that has the label `app: http-echo` defined, allow access to it from pods that have the label `app: busybox` defined.
  
  Run the following in `shell 3` to remove the deny all by default rule, and replace with the above allow rule:
  
    $ kubectl delete netpol deny-all-by-default --namespace=ns-1
    networkpolicy "deny-all-by-default" deleted
    calico $ kubectl create -f templates/allow-network-policy.yaml --namespace=ns-1
    networkpolicy "allow" created
  
  If we repeat the following command in `shell 2`, the call should still timeout and fail (again, you can press CTRL-C to quit after 10 seconds rather than waiting for the full timeout to occur):
  
  ```
  / # wget -S http://http-echo.ns-1.svc.cluster.local/test --post-data '{"message":"hello"}' -O test
  Connecting to http-echo.ns-1.svc.cluster.local (100.64.161.56:80)
  wget: can't connect to remote host (100.64.61.223): Connection timed out
  ```
  
  Why is this still failing even after creating a rule?  It is failing because we configured the rule so that only pods with the label `app: busybox` are authorized to call pods with the label `app: http-echo`.  Let's go ahead and label our `busybox` pod on `shell 3`:
  
    / # kubectl label po --selector=run=busybox --namespace=ns-1 app=busybox
    pod "busybox" labeled
  
  Repeating the test in `shell 2` again should now be successful:
  
  ```
  / # wget -S http://http-echo.ns-1.svc.cluster.local/test --post-data '{"message":"hello"}' -O test
  Connecting to http-echo.ns-1.svc.cluster.local (100.64.161.56:80)
    HTTP/1.1 200 OK
    X-Powered-By: Express
  