anchor.diff:  
   ==== RunAsUser
   
  -. MustRunAs - requires a `runAsUser` to be configured. Uses the configured `runAsUser` as the default.
  -Validates against the configured `runAsUser`.
  -. MustRunAsRange - requires `min` and `max` to be defined if not pre-allocated. Uses `min` as the default.
  -Validates against the entire allowable range.
  -. MustRunAsNonRoot - requires that the pod be submitted with a non-zero `runAsUser` or have the
  -`USER` directive defined in the image.  No default provided.
  -. RunAsAny - no default provided.  Allows any `runAsUser` to be specified.
  +. `MustRunAs` - requires a *runAsUser* to be configured. Uses the configured *runAsUser* as the default.  Validates against the configured *runAsUser*.
  +. `MustRunAsRange` - requires min and max to be defined if not pre-allocated. Uses min as the default.  Validates against the entire allowable range.
  +. `MustRunAsNonRoot` - requires that the pod be submitted with a non-zero *runAsUser* or have the _USER_ directive defined in the image.  No default provided.
  +. `RunAsAny` - no default provided.  Allows any *runAsUser* to be specified.
   
   ==== SELinuxContext
   
  -. MustRunAs - requires `seLinuxOptions` to be configured if not using pre-allocated values, uses
  -`seLinuxOptions` as the default, validates against `seLinuxOptions`.
  -. RunAsAny - no default provided.  Allows any `seLinuxOptions` to be specified.
  +. `MustRunAs` - requires _seLinuxOptions_ to be configured if not using pre-allocated values, uses _seLinuxOptions_ as the default, validates against _seLinuxOptions_.
  +. `RunAsAny` - no default provided.  Allows any _seLinuxOptions_ to be specified.
   
   ==== SupplementalGroups
   
  -. MustRunAs - requires at least one range to be specified unless using pre-allocated values.
  -Uses the min value of the first range as the default.  Validates against all ranges.
  -. RunAsAny - no default provided.  Allows any `supplementalGroups` to be specified.
  +. `MustRunAs` - requires at least one range to be specified unless using pre-allocated values.  Uses the min value of the first range as the default.  Validates against all ranges.
  +. `RunAsAny` - no default provided.  Allows any _supplementalGroups_ to be specified.
   
   ==== FSGroup
   
  -. MustRunAs - requires at least one range to be specified unless using pre-allocated values.
  -Uses the min value of the first range as the default.  Validates against all ranges.
  -. RunAsAny - no default provided.  Allows any `fsGroup` to be specified.
  +. `MustRunAs` - requires at least one range to be specified unless using pre-allocated values.  Uses the min value of the first range as the default.  Validates against the first id in the first range.
  +. `RunAsAny` - no default provided.  Allows any _fsGroup_ id to be specified.
   
   
   [[admission]]
  
positive.code: 
  ==== Understanding pre-allocated values and Security Context Constraints
  
  The admission controller is aware of certain conditions in the security context constraints that trigger
  it to look up pre-allocated values from a namespace and populate the security context constraint
  before processing the pod.
  
  The following security context constraints prompt the admission controller to look for pre-allocated
  values:
  
  . A RunAsUser strategy of MustRunAsRange with no min/max set.  Admission will look for the `openshift.io/sa.scc.uid-range`
  annotation to populate range fields.
  . An SELinux strategy of MustRunAs with no level set.  Admission will look for the `openshift.io/sa.scc.mcs`
  annotation to populate the level.
  . A FSGroup strategy of MustRunAsRange with no ranges set.  Admission will look for the
  `openshift.io/sa.scc.supplemental-groups` annotation.
  . A SupplementalGroups strategy of MustRunAsRange with no ranges set.  Admission will look for
  the `openshift.io/sa.scc.supplemental-groups` annotation.
  During the generation phase, the security context provider will default any values that are not
  specifically set by the user.  Defaulting is based on the strategy being used:
  .. RunAsAny and MustRunAsNonRoot strategies do not provide default values
  .. MustRunAs (single value) strategies provide the value that must be used
  .. MustRunAsRange and MustRunAs (range based) strategies provide the min value of the range.
  If a range based strategy is configurable with multiple ranges it will provide the min value of
  the first configured range.
  
  [NOTE]
  ====
  FSGroup and SupplementalGroup strategies will fall back to the `openshift.io/sa.scc.uid-range`
  annotation if the `openshift.io/sa.scc.supplemental-groups` annotation does not exist on the
  namespace.  If neither exist the SCC will fail to create.
  ====
  
  [NOTE]
  ====
  By default the annotation based FSGroup strategy will configure itself with a single range based
  on the min value for the annotation.  For example, if your annotation reads `1/3` the FSGroup
  strategy will configure itself with a min and max of 1.  If you would like to allow more groups
  to be accepted for the FSGroup field you may configure a custom SCC that does not use the annotation.
  ====
  
  [NOTE]
  ====
  The `openshift.io/sa.scc.supplemental-groups` accepts a comma delimited list of blocks in the
  format of `<start>/<length` or `<start>-<end>`.  The `openshift.io/sa.scc.uid-range` accepts only
  a single block.
  ====
  
negative.code: . Allocating an FSGroup that owns the pod's volumes
  . Configuring allowable supplemental groups
  
  Six SCCs are added to the cluster, by default, and are viewable by cluster administrators using the CLI:
  
  ====
  ----
  $ oc get scc
  NAME               PRIV      CAPS      HOSTDIR   SELINUX     RUNASUSER          FSGROUP    SUPGROUP   PRIORITY
  anyuid             false     []        false     MustRunAs   RunAsAny           RunAsAny   RunAsAny   10
  hostaccess         false     []        true      MustRunAs   MustRunAsRange     RunAsAny   RunAsAny   <none>
  hostmount-anyuid   false     []        true      MustRunAs   RunAsAny           RunAsAny   RunAsAny   <none>
  nonroot            false     []        false     MustRunAs   MustRunAsNonRoot   RunAsAny   RunAsAny   <none>
  privileged         true      []        true      RunAsAny    RunAsAny           RunAsAny   RunAsAny   <none>
  restricted         false     []        false     MustRunAs   MustRunAsRange     RunAsAny   RunAsAny   <none>
  ----
  ====
  
  