anchor.diff:  allowPrivilegedContainer: true
   allowedCapabilities: null
   apiVersion: v1
  +fsGroup: <6>
  +  type: RunAsAny
   groups: <1>
   - system:cluster-admins
   - system:nodes
   kind: SecurityContextConstraints
   metadata:
  +  annotations:
  +    kubernetes.io/description: 'privileged allows access to all privileged and host
  +      features and the ability to run as any user, any group, any fsGroup, and with
  +      any SELinux context.  WARNING: this is the most relaxed SCC and should be used
  +      only for cluster administration. Grant with caution.'
     creationTimestamp: null
     name: privileged
  +priority: null
   runAsUser: <2>
     type: RunAsAny
   seLinuxContext: <3>
     type: RunAsAny
   supplementalGroups: <5>
     type: RunAsAny
  -fsGroup: <6>
  -  type: RunAsAny
   users: <4>
  +- system:serviceaccount:default:registry
  +- system:serviceaccount:default:router
   - system:serviceaccount:openshift-infra:build-controller
   ----
   
  
positive.code: . Allocating an FSGroup that owns the pod's volumes
  . Configuring allowable supplemental groups
  
  Two SCCs are added to the cluster by default, _privileged_ and _restricted_,
  which are viewable by cluster administrators using the CLI:
  
  ====
  ----
  $ oc get scc
  NAME         PRIV      CAPS      HOSTDIR   SELINUX     RUNASUSER
  privileged   true      []        true      RunAsAny    RunAsAny
  restricted   false     []        false     MustRunAs   MustRunAsRange
  ----
  ====
  
  
negative.code: 
  ==== RunAsUser
  
  . `MustRunAs` - requires a *runAsUser* to be configured. Uses the configured *runAsUser* as the default.  Validates against the configured *runAsUser*.
  . `MustRunAsRange` - requires min and max to be defined if not pre-allocated. Uses min as the default.  Validates against the entire allowable range.
  . `MustRunAsNonRoot` - requires that the pod be submitted with a non-zero *runAsUser* or have the _USER_ directive defined in the image.  No default provided.
  . `RunAsAny` - no default provided.  Allows any *runAsUser* to be specified.
  
  ==== SELinuxContext
  
  . `MustRunAs` - requires _seLinuxOptions_ to be configured if not using pre-allocated values, uses _seLinuxOptions_ as the default, validates against _seLinuxOptions_.
  . `RunAsAny` - no default provided.  Allows any _seLinuxOptions_ to be specified.
  
  ==== SupplementalGroups
  
  . `MustRunAs` - requires at least one range to be specified unless using pre-allocated values.  Uses the min value of the first range as the default.  Validates against all ranges.
  . `RunAsAny` - no default provided.  Allows any _supplementalGroups_ to be specified.
  
  ==== FSGroup
  
  . `MustRunAs` - requires at least one range to be specified unless using pre-allocated values.  Uses the min value of the first range as the default.  Validates against the first id in the first range.
  . `RunAsAny` - no default provided.  Allows any _fsGroup_ id to be specified.
  
  
  [[admission]]
  