anchor.diff:  <4> The volume type being used, in this case the *nfs* plug-in.
   <5> The path that is exported by the NFS server.
   <6> The host name or IP address of the NFS server.
  -<7> Defines what happens to a volume when released from its claim. Valid options
  -are *Retain* (default) and *Recycle*. See
  +<7> The reclaim policy for the PV. This defines what happens to a volume when released
  +from its claim. Valid options are *Retain* (default) and *Recycle*. See
   link:#nfs-reclaiming-resources[Reclaiming Resources].
   ====
   
  
positive.code:   securityContext: <1>
      supplementalGroups: [5555] <2>
  ----
  <1> `*securityContext*` must be defined globally to the pod, not under a
  specific container.
  <2> An array of GIDs defined globally for the pod. In this case, there is one
  element in the array; additional GIDs would be comma-separated.
  ====
  
  Assuming there are no custom SCCs that might satisfy the pod's requirements, the
  
negative.code:     securityContext:
        runAsUser: 65534 <2>
  ----
  <1> Pods contain a `*securtityContext*` specific to each container (shown here) and
  a pod-level `*securityContext*` which applies to all containers defined in the pod.
  <2> 65534 is the *nfsnobody* user.
  ====
  
  Assuming the *default* project and the *restricted* SCC, the pod's requested
  