anchor.diff:  RUN pip install ansible==${ANSIBLE_VERSION} boto Jinja2==${JINJA2_VERSION} && \
       rm -rf /root/.cache && \
       find / -type f -regex '.*\.py[co]' -delete
  -
  -# Install Chamber to manage secrets with SSM+KMS
  -#
  -ENV CHAMBER_VERSION 2.0.0
  -RUN curl --fail -sSL -o /usr/local/bin/chamber https://github.com/segmentio/chamber/releases/download/v${CHAMBER_VERSION}/chamber-v${CHAMBER_VERSION}-linux-amd64 \
  -    && chmod +x /usr/local/bin/chamber
  -
  -#
  -# Install goofys
  -#
  -ENV GOOFYS_VERSION 0.19.0
  -RUN curl --fail -sSL -o /usr/local/bin/goofys https://github.com/kahing/goofys/releases/download/v${GOOFYS_VERSION}/goofys \
  -    && chmod +x /usr/local/bin/goofys
   
   #
   # Install Google Cloud SDK
  
positive.code: RUN echo 'set noswapfile' >> /etc/vim/vimrc
  
  WORKDIR /tmp
  # 
  # Install the simple cloudposse package manager
  #
  ARG PACKAGES_VERSION=0.2.2
  ENV PACKAGES_VERSION ${PACKAGES_VERSION}
  RUN git clone --depth=1 -b ${PACKAGES_VERSION} https://github.com/cloudposse/packages.git /packages && rm -rf /packages/.git
  
  #
  # Install packges using the package manager
  #
  ARG PACKAGES="fetch helm kubectx kubens stern terragrunt"
  ENV PACKAGES ${PACKAGES}
  RUN make -C /packages/install ${PACKAGES}
  
  #
  # Copy binaries from packages image 
  #
  COPY --from=packages /packages/bin/cfssl             /usr/local/bin/
  COPY --from=packages /packages/bin/cfssljson         /usr/local/bin/
  
  #
  # Install aws-vault to easily assume roles (not related to HashiCorp Vault)
  #
  ENV AWS_VAULT_VERSION 4.2.0
  ENV AWS_VAULT_BACKEND file
  ENV AWS_VAULT_ASSUME_ROLE_TTL=1h
  #ENV AWS_VAULT_FILE_PASSPHRASE=
  RUN curl --fail -sSL -o /usr/local/bin/aws-vault https://github.com/99designs/aws-vault/releases/download/v${AWS_VAULT_VERSION}/aws-vault-linux-amd64 \
      && chmod +x /usr/local/bin/aws-vault
  
  #
  # Install github-commenter
  #
  ENV GITHUB_COMMENTER_VERSION 0.1.0
  RUN curl --fail -sSL -o /usr/local/bin/github-commenter https://github.com/cloudposse/github-commenter/releases/download/${GITHUB_COMMENTER_VERSION}/github-commenter_linux_amd64 \
      && chmod +x /usr/local/bin/github-commenter
  
  #
  # Install gomplate
  #
  ENV GOMPLATE_VERSION 2.4.0
  RUN curl --fail -sSL -o /usr/local/bin/gomplate https://github.com/hairyhenderson/gomplate/releases/download/v${GOMPLATE_VERSION}/gomplate_linux-amd64-slim \
      && chmod +x /usr/local/bin/gomplate
  
  #
  # Install Terraform
  #
  ENV TERRAFORM_VERSION 0.11.5
  RUN curl --fail -sSL -O https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip \
      && unzip terraform_${TERRAFORM_VERSION}_linux_amd64.zip \
      && rm terraform_${TERRAFORM_VERSION}_linux_amd64.zip \
      && mv terraform /usr/local/bin
  
  #
  # Install kubectl
  #
  ENV KUBECONFIG=${SECRETS_PATH}/kubernetes/kubeconfig
  ENV KUBERNETES_VERSION 1.9.1
  RUN curl --fail -sSL -O https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl \
      && mv kubectl /usr/local/bin/kubectl \
      && chmod +x /usr/local/bin/kubectl \
      && kubectl completion bash > /etc/bash_completion.d/kubectl.sh
  
  #
  # Install kops
  #
  ENV KOPS_VERSION 1.9.1
  ENV KOPS_STATE_STORE s3://undefined
  ENV KOPS_STATE_STORE_REGION us-east-1
  ENV KOPS_FEATURE_FLAGS=+DrainAndValidateRollingUpdate
  
negative.code: ENV KOPS_UTILITY_SUBNETS="172.20.0.0/22,172.20.4.0/22,172.20.8.0/22,172.20.12.0/22"
  ENV KOPS_AVAILABILITY_ZONES="us-west-2a,us-west-2b,us-west-2c"
  ENV KUBECONFIG=/dev/shm/kubecfg
  RUN /usr/local/bin/kops completion bash > /etc/bash_completion.d/kops.sh
  
  # Instance sizes
  ENV BASTION_MACHINE_TYPE "t2.medium"
  