anchor.diff:    Date: Thu, 26 Oct 2017 02:15:32 GMT
     Connection: close
     
  -test4                100% |*************************************************************************************************|   536   0:00:00 ETA
  +test                100% |*************************************************************************************************|   534   0:00:00 ETA
   ```
   
   == Teardown
   
   Remove all the resources and the namespace using the command:
   
  -  kubectl delete ns ns-1
  +  \ # kubectl delete ns ns-1
  +  namespace "ns-1" deleted
   
   == Advanced Topics
   
  
positive.code: 
  The rule above is stating that for every pod that has the label `app: http-echo` defined, allow access to it from pods that have the label `app: busybox` defined.
  
  Run the following to remove the deny all by default rule, and replace with the above allow rule:
  
    $ kubectl delete netpol deny-all-by-default --namespace=ns-1
    networkpolicy "deny-all-by-default" deleted
    calico $ kubectl create -f templates/allow-network-policy.yaml --namespace=ns-1
    networkpolicy "allow" created
  
  If we repeat the following command in shell 2, the call should still timeout and fail:
  
  ```
  / # wget -S http://http-echo.ns-1.svc.cluster.local/test3 --post-data '{"message":"hello"}'
  Connecting to http-echo.ns-1.svc.cluster.local (100.64.161.56:80)
    HTTP/1.1 200 OK
    X-Powered-By: Express
    Content-Type: application/json; charset=utf-8
    Content-Length: 536
    ETag: W/"218-m6+Oqv9DaX+AbeOmSAHlBRCHy04"
    Date: Thu, 26 Oct 2017 02:14:54 GMT
    Connection: close
    
  test3                100% |*************************************************************************************************|   536   0:00:00 ETA
  ```
  
  This is reported as https://github.com/arun-gupta/kubernetes-aws-workshop/issues/106.
  
  Why is this still failing even after creating a rule?  It is failing because we configured the rule so that only pods with the label `app: busybox` are authorized to call pods with the label `app: http-echo`.  Let's go ahead and label our `busybox` pod:
  
    kubectl label po --selector=run=busybox --namespace=ns-1 app=busybox
  
  Repeating the test in shell 2 again should now be successful:
  
  ```
  / # wget -S http://http-echo.ns-1.svc.cluster.local/test4 --post-data '{"message":"hello"}'
  Connecting to http-echo.ns-1.svc.cluster.local (100.64.161.56:80)
    HTTP/1.1 200 OK
    X-Powered-By: Express
  
negative.code: 
  Alternatively, you can create a new cluster and use kops CLI options to specify the networking mode as shown below:
  
    export KOPS_STATE_STORE=s3://prefix-example-com-state-store
    kops create cluster \
      --name cluster2.k8s.local \
      --master-count 1 \
  