anchor.diff:  
   ==== Understanding pre-allocated values and Security Context Constraints
   
  -The admission controller is aware of certain conditions in the security context constraints that trigger
  -it to look up pre-allocated values from a namespace and populate the security context constraint
  -before processing the pod.
  -
  -The following security context constraints prompt the admission controller to look for pre-allocated
  -values:
  -
  -. A RunAsUser strategy of MustRunAsRange with no min/max set.  Admission will look for the `openshift.io/sa.scc.uid-range`
  -annotation to populate range fields.
  -. An SELinux strategy of MustRunAs with no level set.  Admission will look for the `openshift.io/sa.scc.mcs`
  -annotation to populate the level.
  -. A FSGroup strategy of MustRunAsRange with no ranges set.  Admission will look for the
  -`openshift.io/sa.scc.supplemental-groups` annotation.
  -. A SupplementalGroups strategy of MustRunAsRange with no ranges set.  Admission will look for
  -the `openshift.io/sa.scc.supplemental-groups` annotation.
  -During the generation phase, the security context provider will default any values that are not
  -specifically set by the user.  Defaulting is based on the strategy being used:
  -.. RunAsAny and MustRunAsNonRoot strategies do not provide default values
  -.. MustRunAs (single value) strategies provide the value that must be used
  -.. MustRunAsRange and MustRunAs (range based) strategies provide the min value of the range.
  -If a range based strategy is configurable with multiple ranges it will provide the min value of
  -the first configured range.
  +The admission controller is aware of certain conditions in the security context constraints that trigger it to look up pre-allocated values from a namespace and populate the security context constraint before processing the pod. Each SCC strategy is evaluted indpendently of other strategies, with the pre-allocated (default) values for each policy aggregated to make the final values for the various ids defined in the pod.
  +
  +The following security context constraints cause the admission controller to look for pre-allocated values:
  +
  +. A *RunAsUser* strategy of `MustRunAsRange` with no min/max set.  Admission will look for the "openshift.io/sa.scc.uid-range" annotation to populate range fields.
  +. An *SELinuxContext* strategy of `MustRunAs` with no level set.  Admission will look for the "openshift.io/sa.scc.mcs" annotation to populate the level.
  +. A *FSGroup* strategy of `MustRunAs`.  Admission will look for the "openshift.io/sa.scc.supplemental-groups" annotation.
  +. A *SupplementalGroups* strategy of `MustRunAs`.  Admission will look for the "openshift.io/sa.scc.supplemental-groups" annotation.
  +
  +During the generation phase, the security context provider will default any values that are not specifically set in the pod.  Defaulting is based on the strategy being used:
  +
  +. *RunAsAny* and *MustRunAsNonRoot* strategies do not provide default values. Thus, if the pod needs a group id this id must be defined in the pod spec.
  +. *MustRunAs* (single value) strategies provide a default value which is always used. Thus, even if the pod spec defines its own group id value, the namespace's default group id will also appear in the pod's groups.
  +. *MustRunAsRange* and *MustRunAs* (range based) strategies provide the min value of the range. As with a single value `MustRunAs` strategy, the namespace's default group id will always appear in the pod's list of groups.
  +If a range based strategy is configurable with multiple ranges it will provide the min value of the first configured range.
   
   [NOTE]
   ====
  -FSGroup and SupplementalGroup strategies will fall back to the `openshift.io/sa.scc.uid-range`
  -annotation if the `openshift.io/sa.scc.supplemental-groups` annotation does not exist on the
  -namespace.  If neither exist the SCC will fail to create.
  +*FSGroup* and *SupplementalGroups* strategies will fall back to the "openshift.io/sa.scc.uid-range" annotation if the "openshift.io/sa.scc.supplemental-groups" annotation does not exist on the namespace.  If neither exist the SCC will fail to create.
   ====
   
   [NOTE]
   ====
  -By default the annotation based FSGroup strategy will configure itself with a single range based
  -on the min value for the annotation.  For example, if your annotation reads `1/3` the FSGroup
  -strategy will configure itself with a min and max of 1.  If you would like to allow more groups
  -to be accepted for the FSGroup field you may configure a custom SCC that does not use the annotation.
  +By default the annotation based *FSGroup* strategy will configure itself with a single range based on the min value for the annotation.  For example, if your annotation reads `1/3` the *FSGroup* strategy will configure itself with a min and max of 1.  If you would like to allow more groups to be accepted for the FSGroup field you may configure a custom SCC that does not use the annotation.
   ====
   
   [NOTE]
   ====
  -The `openshift.io/sa.scc.supplemental-groups` accepts a comma delimited list of blocks in the
  -format of `<start>/<length` or `<start>-<end>`.  The `openshift.io/sa.scc.uid-range` accepts only
  -a single block.
  -====
  +The "openshift.io/sa.scc.supplemental-groups" accepts a comma delimited list of blocks in the format of `<start>/<length` or `<start>-<end>`.  The "openshift.io/sa.scc.uid-range" accepts only a single block.
  +====
  
positive.code: the pod:
  
  . Retrieve all SCCs available for use.
  . Generate field values for any security context setting that was not specified
  on the request.
  . Validate the final settings against the available constraints.
  
  If a matching set of constraints is found, then the pod is accepted. If the
  request cannot be matched to an SCC, the pod is rejected.
  
negative.code: ====
  ----
  # oc export scc/privileged
  
  allowHostDirVolumePlugin: true
  allowHostIPC: true
  allowHostNetwork: true
  