anchor.diff:    creationTimestamp: null
     name: privileged
   priority: null
  -runAsUser: <2>
  +runAsUser: <3>
     type: RunAsAny
  -seLinuxContext: <3>
  +seLinuxContext: <4>
     type: RunAsAny
   supplementalGroups: <5>
     type: RunAsAny
  -users: <4>
  +users: <6>
   - system:serviceaccount:default:registry
   - system:serviceaccount:default:router
   - system:serviceaccount:openshift-infra:build-controller
   ----
   
  -<1> The groups that have access to this SCC
  -<2> The run as user strategy type which dictates the allowable values for the Security Context
  -<3> The SELinux context strategy type which dictates the allowable values for the Security Context
  -<4> The users who have access to this SCC
  -<5> The supplemental groups strategy which dictates the allowable supplemental groups for the Security Context
  -<6> The FSGroup strategy which dictates the allowable values for the Security Context
  +<1> The `*FSGroup*` strategy which dictates the allowable values for the
  +Security Context
  +<2> The groups that have access to this SCC
  +<3> The run as user strategy type which dictates the allowable values for the
  +Security Context
  +<4> The SELinux context strategy type which dictates the allowable values for
  +the Security Context
  +<5> The supplemental groups strategy which dictates the allowable supplemental
  +groups for the Security Context
  +<6> The users who have access to this SCC
  +
   ====
   
   The `*users*` and `*groups*` fields on the SCC control which SCCs can be used.
  
positive.code: on the request.
  . Validate the final settings against the available constraints.
  
  A pod must validate every field against the SCC. Below are examples of just two of the fields that must be validated (note: this is in the context of a strategy using the preallocated values):
  
  . a *FSGroup* SCC strategy of `MustRunAs`: if the pod defines a _fsGroup_ id then that id must equal the default FSGroup id. Otherwise, the pod is not validated by that SCC and the next SCC is evaluated. If the *FSGroup* strategy is `RunAsAny` and the pod omits a _fsGroup_ id then the pod matches the SCC based on FSGroup (though other strategies may not validate and thus cause the pod to fail).
  . a *SupplementalGroups* SCC strategy of `MustRunAs`: if the pod spec defines a _SupplementalGroups_ id(s) then the pod's id(s) must equal one of the ids in the namespace's "openshift.io/sa.scc.supplemental-groups" annotation. Otherwise, the pod is not validated by that SCC and the next SCC is evaluated. If the *SupplementalGroups* setting is `RunAsAny` and the pod spec omits a _SupplementalGroups_ id then the pod matches the SCC based on SupplementalGroups (though other strategies may not validate and thus cause the pod to fail).
  
  If a matching set of constraints is found, then the pod is accepted. If the
  request cannot be matched to an SCC, the pod is rejected.
  
  ==== SCC Prioritization
  
  
negative.code: 
  ==== RunAsUser
  
  . *MustRunAs* - Requires a `*runAsUser*` to be configured. Uses the configured
  `*runAsUser*` as the default. Validates against the configured `*runAsUser*`.
  . *MustRunAsRange* - Requires minimum and maximum values to be defined if not
  using pre-allocated values. Uses the minimum as the default. Validates against
  the entire allowable range.
  . *MustRunAsNonRoot* - Requires that the pod be submitted with a non-zero
  `*runAsUser*` or have the `USER` directive defined in the image. No default
  provided.
  . *RunAsAny* - No default provided. Allows any `*runAsUser*` to be specified.
  
  ==== SELinuxContext
  
  . *MustRunAs* - Requires `*seLinuxOptions*` to be configured if not using
  pre-allocated values. Uses `*seLinuxOptions*` as the default. Validates against
  `*seLinuxOptions*`.
  . *RunAsAny* - No default provided. Allows any `*seLinuxOptions*` to be
  specified.
  
  ==== SupplementalGroups
  
  . *MustRunAs* - Requires at least one range to be specified if not using
  pre-allocated values. Uses the minimum value of the first range as the default.
  Validates against all ranges.
  . *RunAsAny* - No default provided. Allows any `*supplementalGroups*` to be
  specified.
  
  ==== FSGroup
  
  . *MustRunAs* - Requires at least one range to be specified if not using
  pre-allocated values. Uses the minimum value of the first range as the default.
  Validates against the first ID in the first range.
  . *RunAsAny* - No default provided. Allows any `*fsGroup*` ID to be specified.
  
  
  [[admission]]
  