anchor.diff:  The approach is to specify an `ingressIPNetworkCIDR` range and then use the same range in creating the ipfailover configuration.
   
   Since, ipfailover can support up to a maximum of 255 VIPs for the entire cluster, the `ingressIPNetworkCIDR` needs to be `/24` or less.
  -
  
positive.code: | Option | Variable Name | Default | Notes
  
  |`--watch-port`
  |`*OPENSHIFT_HA_MONITOR_PORT*`
  |80
  |The ipfailover pod tries to open a TCP connection to this port on each VIP. If connection is established, the service is considered to be running. If this port is set to 0, the test always passes.
  
  |`--interface`
  |`*OPENSHIFT_HA_NETWORK_INTERFACE*`
  |
  |The interface name for the ip failover to use, to send VRRP traffic. By default, `eth0` is used.
  
  |`--replicas`
  |`*OPENSHIFT_HA_REPLICA_COUNT*`
  |2
  |Number of replicas to create. This must match `spec.replicas` value in ipfailover deployment configration.
  
  |`--virtual-ips`
  |`*OPENSHIFT_HA_VIRTUAL_IPS*`
  |
  |The list of IP address ranges to replicate. This must be provided. E.g., 1.2.3.4-6,1.2.3.9
  Please see xref:../admin_guide/high_availability.adoc#ha-vrrp-id-offset[this discussion] for more details.
  
  |`--vrrp-id-offset`
  |`*OPENSHIFT_HA_VRRP_ID_OFFSET*`
  |0
  |Please see xref:../admin_guide/high_availability.adoc#ha-vrrp-id-offset[VRRP Id Offset] discussion for more details.
  
  |`--iptables-chain`
  |`*OPENSHIFT_HA_IPTABLES_CHAIN*`
  |INPUT
  |The name of the iptables chain, to automatically add an `iptables` rule to allow the VRRP traffic on. If the value is not set, an `iptables` rule will not be added. If the chain does not exist, it is not created.
  
  |`--check-script`
  |`*OPENSHIFT_HA_CHECK_SCRIPT*`
  |
  |Full path name in the pod filesystem of a script that will be periodically run to verify the application is operating.  Please see xref:../admin_guide/high_availability.adoc#check-notify[this discussion] for more details.
  
  |`--check-interval`
  |`*OPENSHIFT_HA_CHECK_INTERVAL*`
  |2
  |The period, in seconds that the check script is run.
  
  |`--notify-script`
  |`*OPENSHIFT_HA_NOTIFY_SCRIPT*`
  |
  |Full path name in the pod filesystem of a script that is run whenever the state changes.  Please see xref:../admin_guide/high_availability.adoc#check-notify[this discussion] for more details.
  
  |===
  
  [[ha-vrrp-id-offset]]
  === VRRP Id Offset
  Each ipfailover pod managed by the ipfailover deployment configration (1 pod per node/replica) runs a *keepalived* daemon. As more ipfailover deployment configrations are configured, more pods are created and more daemons join into the common VRRP negotiation. This negotiation is done by all the *keepalived* daemons and it determines which nodes will service which VIPs.
  
  Internally, *keepalived* assigns a unique vrrp-id to each VIP. The negotiation uses this set of vrrp-ids, when a decision is made, the VIP corresponding to the winning vrrp-id is serviced on the winning node.
  
negative.code: 
  The `iptables` rule can be removed after the last *keepalived* daemon terminates. The rule is not automatically removed.
  
  You can manually manage the `iptables` rule on each of the nodes. It only gets created when none is present (as long as ipfailover is not created with the -`-iptable-chain=""` option).
  
  [IMPORTANT]
  ====
  