anchor.diff:  allowPrivilegedContainer: true
   allowedCapabilities: null
   apiVersion: v1
  -fsGroup: <6>
  +fsGroup: <1>
     type: RunAsAny
  -groups: <1>
  +groups: <2>
   - system:cluster-admins
   - system:nodes
   kind: SecurityContextConstraints
  
positive.code: on the request.
  . Validate the final settings against the available constraints.
  
  A pod must validate every field against the SCC. Below are examples of just two of the fields that must be validated (note: this is in the context of a strategy using the preallocated values):
  
  . a *FSGroup* SCC strategy of `MustRunAs`: if the pod defines a _fsGroup_ id then that id must equal the default FSGroup id. Otherwise, the pod is not validated by that SCC and the next SCC is evaluated. If the *FSGroup* strategy is `RunAsAny` and the pod omits a _fsGroup_ id then the pod matches the SCC based on FSGroup (though other strategies may not validate and thus cause the pod to fail).
  . a *SupplementalGroups* SCC strategy of `MustRunAs`: if the pod spec defines a _SupplementalGroups_ id(s) then the pod's id(s) must equal one of the ids in the namespace's "openshift.io/sa.scc.supplemental-groups" annotation. Otherwise, the pod is not validated by that SCC and the next SCC is evaluated. If the *SupplementalGroups* setting is `RunAsAny` and the pod spec omits a _SupplementalGroups_ id then the pod matches the SCC based on SupplementalGroups (though other strategies may not validate and thus cause the pod to fail).
  
  If a matching set of constraints is found, then the pod is accepted. If the
  request cannot be matched to an SCC, the pod is rejected.
  
  ==== SCC Prioritization
  
  
negative.code: user by without specifying a `RunAsUser` on the pod's `SecurityContext`.  The
  administrator may still specify a `RunAsUser` if they wish.
  
  ==== Understanding Pre-allocated Values and Security Context Constraints
  
  The admission controller is aware of certain conditions in the security context
  constraints that trigger it to look up pre-allocated values from a namespace and
  populate the security context constraint before processing the pod. Each SCC
  strategy is evaluated independently of other strategies, with the pre-allocated
  values (where allowed) for each policy aggregated with pod specification values
  to make the final values for the various IDs defined in the running pod.
  
  The following SCCs cause the admission controller to look for pre-allocated
  values when no ranges are defined in the pod specification:
  
  . A `*RunAsUser*` strategy of *MustRunAsRange* with no minimum or maximum set.
  Admission looks for the *openshift.io/sa.scc.uid-range* annotation to populate
  range fields.
  . An `*SELinuxContext*` strategy of *MustRunAs* with no level set. Admission
  looks for the *openshift.io/sa.scc.mcs* annotation to populate the level.
  . A `*FSGroup*` strategy of *MustRunAs*. Admission looks for the
  *openshift.io/sa.scc.supplemental-groups* annotation.
  . A `*SupplementalGroups*` strategy of *MustRunAs*. Admission looks for the
  *openshift.io/sa.scc.supplemental-groups* annotation.
  
  During the generation phase, the security context provider will default any
  values that are not specifically set in the pod. Defaulting is based on the
  strategy being used:
  
  . `*RunAsAny*` and `*MustRunAsNonRoot*` strategies do not provide default
  values. Thus, if the pod needs a field defined (for example, a group ID), this
  field must be defined inside the pod specification.
  . `*MustRunAs*` (single value) strategies provide a default value which is
  always used. As an example, for group IDs: even if the pod specification defines
  its own ID value, the namespace's default field will also appear in the pod's
  groups.
  . `*MustRunAsRange*` and `*MustRunAs*` (range-based) strategies provide the
  minimum value of the range. As with a single value `*MustRunAs*` strategy, the
  namespace's default value will appear in the running pod. If a range-based
  strategy is configurable with multiple ranges, it will provide the minimum value
  of the first configured range.
  
  [NOTE]
  ====
  `*FSGroup*` and `*SupplementalGroups*` strategies fall back to the
  *openshift.io/sa.scc.uid-range* annotation if the
  *openshift.io/sa.scc.supplemental-groups* annotation does not exist on the
  namespace. If neither exist, the SCC will fail to create.
  ====
  
  [NOTE]
  ====
  By default, the annotation-based `*FSGroup*` strategy configures itself with a
  single range based on the minimum value for the annotation. For example, if your
  annotation reads *1/3*, the `*FSGroup*` strategy will configure itself with a
  minimum and maximum of *1*. If you want to allow more groups to be accepted for
  the `*FSGroup*` field, you can configure a custom SCC that does not use the
  annotation.
  ====
  
  [NOTE]
  ====
  The *openshift.io/sa.scc.supplemental-groups* annotation accepts a comma
  delimited list of blocks in the format of `<start>/<length` or `<start>-<end>`.
  The *openshift.io/sa.scc.uid-range* annotation accepts only a single block.
  ====
  