anchor.diff:  It shows the output:
   
   ```
  -$ kops update cluster cluster.k8s.local --yes
   I1025 15:56:26.679683    3458 apply_cluster.go:420] Gossip DNS: skipping DNS validation
   W1025 15:56:26.701541    3458 firewall.go:202] Opening etcd port on masters for access from the nodes, for calico.  This is unsafe in untrusted environments.
   I1025 15:56:27.214980    3458 executor.go:91] Tasks: 0 done / 72 total; 34 can run
  
positive.code: 
    kops update cluster cluster.k8s.local
  
  It shows an output as:
  
  ```
  $ kops update cluster cluster.k8s.local
  I1025 15:55:45.512183    3454 apply_cluster.go:420] Gossip DNS: skipping DNS validation
  W1025 15:55:45.534000    3454 firewall.go:202] Opening etcd port on masters for access from the nodes, for calico.  This is unsafe in untrusted environments.
  I1025 15:55:45.536302    3454 executor.go:91] Tasks: 0 done / 72 total; 34 can run
  
negative.code: 
  ```
  $ kops rolling-update cluster cluster.k8s.local
  NAME              STATUS      NEEDUPDATE  READY MIN MAX NODES
  master-us-east-1d NeedsUpdate 1           0     1   1   1
  nodes             NeedsUpdate 2           0     2   2   2
  
  Must specify --yes to rolling-update.
  ```
  
  The `STATUS` column shows that both master and worker nodes need to be updated.
  
    kops rolling-update cluster cluster.k8s.local --yes
  
  Output from this command is shown:
  
  ```
  NAME              STATUS      NEEDUPDATE  READY MIN MAX NODES
  master-us-east-1d NeedsUpdate 1           0     1   1   1
  nodes             NeedsUpdate 2           0     2   2   2
  I1025 16:16:31.978851    3733 instancegroups.go:350] Stopping instance "i-0cdcb2e51e5656b44", node "ip-172-20-44-219.ec2.internal", in AWS ASG "master-us-east-1d.masters.cluster.k8s.local".
  I1025 16:21:32.411639    3733 instancegroups.go:350] Stopping instance "i-060b2c9652e2075ac", node "ip-172-20-54-182.ec2.internal", in AWS ASG "nodes.cluster.k8s.local".
  I1025 16:23:32.973648    3733 instancegroups.go:350] Stopping instance "i-0baffcbc9a758a6c4", node "ip-172-20-94-82.ec2.internal", in AWS ASG "nodes.cluster.k8s.local".
  I1025 16:25:33.784129    3733 rollingupdate.go:174] Rolling update completed!
  ```
  
  == Configuration: Enforcing Network Isolation
  
  Let's configure Calico.
  
  We will create a namespace, deploy some test pods into it, and see the before and after effects of configuring a Calico based Network Policy.
  
  === Precheck
  
  . Create a namespace:
  
    $ kubectl create ns ns-1
    namespace "ns-1" created
  
  . Deploy a container into namespace `ns-1` that will expose an http endpoint, and log all requests it receives. First, create a Deployment, ReplicaSet and Pod using the command:
  
    $ kubectl run --namespace=ns-1 http-echo --image=solsson/http-echo --env="PORT=80" --port=80
    deployment "http-echo" created
  
  . Label the pod (we will use labels as part of defining network policies):
  
    $ kubectl label po --selector=run=http-echo --namespace=ns-1 app=http-echo
    pod "http-echo-1790350443-z2v7n" labeled
  
  . Create a Service to expose the pod:
  
    $ kubectl expose --namespace=ns-1 deployment http-echo --port=80
    service "http-echo" exposed
  +
  Monitor the logs of the deployed container by querying the name of the pod defined with the label `run-http-echo`, then passing it to the `kubectl logs` command:
  +
  ```
  $ kubectl get po \
    --selector=run=http-echo \
    --namespace=ns-1 \
    -o jsonpath='{.items[*].metadata.name}' | \
    xargs kubectl logs -f --namespace=ns-1
  npm info it worked if it ends with ok
  npm info using npm@5.0.3
  npm info using node@v8.1.3
  