anchor.diff:  Validates against the first ID in the first range.
   . *RunAsAny* - No default provided. Allows any `*fsGroup*` ID to be specified.
   
  +[[authorization-controlling-volumes]]
   === Controlling Volumes
   
  -The usage of specific volume types can be controlled by setting the `*volumes*` field
  -of the SCC.  The allowable values of this field correspond to the volume sources that
  -are defined when creating a volume:
  -
  -.  azureFile
  -.  flocker
  -.  flexVolume
  -.  hostPath
  -.  emptyDir
  -.  gcePersistentDisk
  -.  awsElasticBlockStore
  -.  gitRepo
  -.  secret
  -.  nfs
  -.  iscsi
  -.  glusterfs
  -.  persistentVolumeClaim
  -.  rbd
  -.  cinder
  -.  cephFS
  -.  downwardAPI
  -.  fc
  -.  configMap
  -.  *
  -
  -The recommended minimum set of allowed volumes for new SCCs are configMap, downwardAPI, emptyDir,
  -persistentVolumeClaim, and secret.
  +The usage of specific volume types can be controlled by setting the `*volumes*`
  +field of the SCC. The allowable values of this field correspond to the volume
  +sources that are defined when creating a volume:
  +
  +* *azureFile*
  +* *flocker*
  +* *flexVolume*
  +* *hostPath*
  +* *emptyDir*
  +* *gcePersistentDisk*
  +* *awsElasticBlockStore*
  +* *gitRepo*
  +* *secret*
  +* *nfs*
  +* *iscsi*
  +* *glusterfs*
  +* *persistentVolumeClaim*
  +* *rbd*
  +* *cinder*
  +* *cephFS*
  +* *downwardAPI*
  +* *fc*
  +* *configMap*
  +*  ***
  +
  +The recommended minimum set of allowed volumes for new SCCs are *configMap*,
  +*downwardAPI*, *emptyDir*, *persistentVolumeClaim*, and *secret*.
   
   [NOTE]
   ====
  -`***` is a special value to allow the use of all volume types
  +`***` is a special value to allow the use of all volume types.
   ====
   
   [NOTE]
   ====
  -For backwards compatibility, the usage of `*allowHostDirVolumePlugin*` will override settings
  -in the `*volumes*` field.  For example, if `*allowHostDirVolumePlugin*` is set to false but allowed
  -in the `*volumes*` field the `*hostPath*` value will be removed from `*volumes*`.
  +For backwards compatibility, the usage of `*allowHostDirVolumePlugin*` overrides
  +settings in the `*volumes*` field.  For example, if `*allowHostDirVolumePlugin*`
  +is set to false but allowed in the `*volumes*` field, then the `*hostPath*`
  +value will be removed from `*volumes*`.
   ====
   
   
  
positive.code: . *RunAsAny* - No default provided. Allows any `*seLinuxOptions*` to be
  specified.
  
  ==== SupplementalGroups
  
  . *MustRunAs* - Requires at least one range to be specified if not using
  
negative.code: . *RunAsAny* - No default provided. Allows any `*supplementalGroups*` to be
  specified.
  
  [[authorization-FSGroup]]
  ==== FSGroup
  
  . *MustRunAs* - Requires at least one range to be specified if not using
  