anchor.diff:    schedulerName: default-scheduler
     terminationGracePeriodSeconds: 30
     nodeName: ip-10-0-140-16.us-east-2.compute.internal
  -  securityContext:     <3>
  +  securityContext: <3>
       seLinuxOptions:
         level: 's0:c11,c10'
  -  containers:          <4>
  +  containers: <4>        
       - resources: {}
         terminationMessagePath: /dev/termination-log
         name: hello-openshift
  
positive.code:         - containerPort: 8080
            protocol: TCP
        imagePullPolicy: Always
        volumeMounts:             <5>
          - name: default-token-wbqsl
            readOnly: true
            mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        terminationMessagePolicy: File
        image: registry.redhat.io/openshift4/ose-ogging-eventrouter:v4.3 <6>
    serviceAccount: default     <7>
    volumes:                    <8>
      - name: default-token-wbqsl
        secret:
          secretName: default-token-wbqsl
  
negative.code:   qosClass: BestEffort
  ----
  
  <1> Pods can be "tagged" with one or more labels, which can then be used to select and manage groups of pods in a single operation. The labels are stored in key/value format in the `metadata` hash.
  <2> The pod restart policy with possible values `Always`, `OnFailure`, and `Never`. The default value is `Always`.
  <3> {product-title} defines a security context for containers which specifies whether they are allowed to run as privileged containers, run as a user of their choice, and more. The default context is very restrictive but administrators can modify this as needed.
  <4> `containers` specifies an array of one or more container definitions.
  <5> The container specifies where external storage volumes are mounted within the container. In this case, there is a volume for storing the default the CA bundle.
  <6> Each container in the pod is instantiated from its own container image.
  <7> Pods making requests against the {product-title} API is a common enough pattern that there is a `serviceAccount` field for specifying which service account user the pod should authenticate as when making the requests. This enables fine-grained access control for custom infrastructure components.
  <8> The pod defines storage volumes that are available to its container(s) to use. In this case, it provides an ephemeral volume for a `secret` volume containing the default service account tokens.
  
  [NOTE]
  ====
  This pod definition does not include attributes that are filled by {product-title} automatically after the pod is created and its lifecycle begins. The link:https://kubernetes.io/docs/concepts/workloads/pods/pod/[Kubernetes pod documentation] has details about the functionality and purpose of pods.
  ====
  