anchor.diff:  allowPrivilegedContainer: true
   allowedCapabilities: null
   apiVersion: v1
  +defaultAddCapabilities: null
   fsGroup: <1>
     type: RunAsAny
   groups: <2>
  
positive.code:   creationTimestamp: null
    name: privileged
  priority: null
  runAsUser: <3>
    type: RunAsAny
  seLinuxContext: <4>
  
negative.code: pre-allocated values. Uses the minimum value of the first range as the default.
  Validates against the first ID in the first range.
  . *RunAsAny* - No default provided. Allows any `*fsGroup*` ID to be specified.
  
  === Controlling Volumes
  
  The usage of specific volume types can be controlled by setting the `*volumes*` field
  of the SCC.  The allowable values of this field correspond to the volume sources that
  are defined when creating a volume:
  
  .  azureFile
  .  flocker
  .  flexVolume
  .  hostPath
  .  emptyDir
  .  gcePersistentDisk
  .  awsElasticBlockStore
  .  gitRepo
  .  secret
  .  nfs
  .  iscsi
  .  glusterfs
  .  persistentVolumeClaim
  .  rbd
  .  cinder
  .  cephFS
  .  downwardAPI
  .  fc
  .  configMap
  .  *
  
  The recommended minimum set of allowed volumes for new SCCs are configMap, downwardAPI, emptyDir,
  persistentVolumeClaim, and secret.
  
  [NOTE]
  ====
  `***` is a special value to allow the use of all volume types
  ====
  
  [NOTE]
  ====
  For backwards compatibility, the usage of `*allowHostDirVolumePlugin*` will override settings
  in the `*volumes*` field.  For example, if `*allowHostDirVolumePlugin*` is set to false but allowed
  in the `*volumes*` field the `*hostPath*` value will be removed from `*volumes*`.
  ====
  
  
  [[admission]]
  