anchor.diff:  . The use of host namespaces and networking.
   . Allocating an `*FSGroup*` that owns the pod's volumes
   . Configuring allowable supplemental groups
  +. Requiring the use of a read only root file system
  +. Controlling the usage of volume types
   
   Six SCCs are added to the cluster by default, and are viewable by cluster
   administrators using the CLI:
  
positive.code: pre-allocated values. Uses the minimum value of the first range as the default.
  Validates against the first ID in the first range.
  . *RunAsAny* - No default provided. Allows any `*fsGroup*` ID to be specified.
  
  
  [[admission]]
  
negative.code: allowPrivilegedContainer: true
  allowedCapabilities: null
  apiVersion: v1
  defaultAddCapabilities: null
  fsGroup: <1>
    type: RunAsAny
  groups: <2>
  