anchor.diff:  
   ==== RunAsUser
   
  -. `MustRunAs` - requires a *runAsUser* to be configured. Uses the configured *runAsUser* as the default.  Validates against the configured *runAsUser*.
  -. `MustRunAsRange` - requires min and max to be defined if not pre-allocated. Uses min as the default.  Validates against the entire allowable range.
  -. `MustRunAsNonRoot` - requires that the pod be submitted with a non-zero *runAsUser* or have the _USER_ directive defined in the image.  No default provided.
  -. `RunAsAny` - no default provided.  Allows any *runAsUser* to be specified.
  +. *MustRunAs* - Requires a `*runAsUser*` to be configured. Uses the configured
  +`*runAsUser*` as the default. Validates against the configured `*runAsUser*`.
  +. *MustRunAsRange* - Requires minimum and maximum values to be defined if not
  +using pre-allocated values. Uses the minimum as the default. Validates against
  +the entire allowable range.
  +. *MustRunAsNonRoot* - Requires that the pod be submitted with a non-zero
  +`*runAsUser*` or have the `USER` directive defined in the image. No default
  +provided.
  +. *RunAsAny* - No default provided. Allows any `*runAsUser*` to be specified.
   
   ==== SELinuxContext
   
  -. `MustRunAs` - requires _seLinuxOptions_ to be configured if not using pre-allocated values, uses _seLinuxOptions_ as the default, validates against _seLinuxOptions_.
  -. `RunAsAny` - no default provided.  Allows any _seLinuxOptions_ to be specified.
  +. *MustRunAs* - Requires `*seLinuxOptions*` to be configured if not using
  +pre-allocated values. Uses `*seLinuxOptions*` as the default. Validates against
  +`*seLinuxOptions*`.
  +. *RunAsAny* - No default provided. Allows any `*seLinuxOptions*` to be
  +specified.
   
   ==== SupplementalGroups
   
  -. `MustRunAs` - requires at least one range to be specified unless using pre-allocated values.  Uses the min value of the first range as the default.  Validates against all ranges.
  -. `RunAsAny` - no default provided.  Allows any _supplementalGroups_ to be specified.
  +. *MustRunAs* - Requires at least one range to be specified if not using
  +pre-allocated values. Uses the minimum value of the first range as the default.
  +Validates against all ranges.
  +. *RunAsAny* - No default provided. Allows any `*supplementalGroups*` to be
  +specified.
   
   ==== FSGroup
   
  -. `MustRunAs` - requires at least one range to be specified unless using pre-allocated values.  Uses the min value of the first range as the default.  Validates against the first id in the first range.
  -. `RunAsAny` - no default provided.  Allows any _fsGroup_ id to be specified.
  +. *MustRunAs* - Requires at least one range to be specified if not using
  +pre-allocated values. Uses the minimum value of the first range as the default.
  +Validates against the first ID in the first range.
  +. *RunAsAny* - No default provided. Allows any `*fsGroup*` ID to be specified.
   
   
   [[admission]]
  
positive.code: 
  [NOTE]
  ====
  For more information about each SCC please refer to the `kubernetes.io/description`
  annotation available on the SCC.
  ====
  
  
negative.code: . The SELinux context of the container.
  . The user ID.
  . The use of host namespaces and networking.
  . Allocating an `*FSGroup*` that owns the pod's volumes
  . Configuring allowable supplemental groups
  
  Six SCCs are added to the cluster by default, and are viewable by cluster
  administrators using the CLI:
  
  ====
  ----
  