anchor.diff:  . The SELinux context of the container.
   . The user ID.
   . The use of host namespaces and networking.
  -. Allocating an FSGroup that owns the pod's volumes
  +. Allocating an `*FSGroup*` that owns the pod's volumes
   . Configuring allowable supplemental groups
   
  -Six SCCs are added to the cluster, by default, and are viewable by cluster administrators using the CLI:
  +Six SCCs are added to the cluster by default, and are viewable by cluster
  +administrators using the CLI:
   
   ====
   ----
  
positive.code: on the request.
  . Validate the final settings against the available constraints.
  
  A pod must validate every field against the SCC. Below are examples of just two of the fields that must be validated (note: this is in the context of a strategy using the preallocated values):
  
  . a *FSGroup* SCC strategy of `MustRunAs`: if the pod defines a _fsGroup_ id then that id must equal the default FSGroup id. Otherwise, the pod is not validated by that SCC and the next SCC is evaluated. If the *FSGroup* strategy is `RunAsAny` and the pod omits a _fsGroup_ id then the pod matches the SCC based on FSGroup (though other strategies may not validate and thus cause the pod to fail).
  . a *SupplementalGroups* SCC strategy of `MustRunAs`: if the pod spec defines a _SupplementalGroups_ id(s) then the pod's id(s) must equal one of the ids in the namespace's "openshift.io/sa.scc.supplemental-groups" annotation. Otherwise, the pod is not validated by that SCC and the next SCC is evaluated. If the *SupplementalGroups* setting is `RunAsAny` and the pod spec omits a _SupplementalGroups_ id then the pod matches the SCC based on SupplementalGroups (though other strategies may not validate and thus cause the pod to fail).
  
  If a matching set of constraints is found, then the pod is accepted. If the
  request cannot be matched to an SCC, the pod is rejected.
  
  ==== SCC Prioritization
  
  
negative.code: 
  [NOTE]
  ====
  For more information about each SCC, see the *kubernetes.io/description*
  annotation available on the SCC.
  ====
  
  