anchor.diff:  ====
   ----
   $ oc get scc
  -NAME               PRIV      CAPS      HOSTDIR   SELINUX     RUNASUSER          FSGROUP    SUPGROUP   PRIORITY
  -anyuid             false     []        false     MustRunAs   RunAsAny           RunAsAny   RunAsAny   10
  -hostaccess         false     []        true      MustRunAs   MustRunAsRange     RunAsAny   RunAsAny   <none>
  -hostmount-anyuid   false     []        true      MustRunAs   RunAsAny           RunAsAny   RunAsAny   <none>
  -nonroot            false     []        false     MustRunAs   MustRunAsNonRoot   RunAsAny   RunAsAny   <none>
  -privileged         true      []        true      RunAsAny    RunAsAny           RunAsAny   RunAsAny   <none>
  -restricted         false     []        false     MustRunAs   MustRunAsRange     RunAsAny   RunAsAny   <none>
  +NAME               PRIV      CAPS      SELINUX     RUNASUSER          FSGROUP     SUPGROUP    PRIORITY   READONLYROOTFS   VOLUMES
  +anyuid             false     []        MustRunAs   RunAsAny           RunAsAny    RunAsAny    10         false            [configMap downwardAPI emptyDir persistentVolumeClaim secret]
  +hostaccess         false     []        MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <none>     false            [configMap downwardAPI emptyDir hostPath persistentVolumeClaim secret]
  +hostmount-anyuid   false     []        MustRunAs   RunAsAny           RunAsAny    RunAsAny    <none>     false            [configMap downwardAPI emptyDir hostPath persistentVolumeClaim secret]
  +hostnetwork        false     []        MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <none>     false            [configMap downwardAPI emptyDir persistentVolumeClaim secret]
  +nonroot            false     []        MustRunAs   MustRunAsNonRoot   RunAsAny    RunAsAny    <none>     false            [configMap downwardAPI emptyDir persistentVolumeClaim secret]
  +privileged         true      []        RunAsAny    RunAsAny           RunAsAny    RunAsAny    <none>     false            [*]
  +restricted         false     []        MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <none>     false            [configMap downwardAPI emptyDir persistentVolumeClaim secret]
  +
   ----
   ====
   
  
positive.code: allowPrivilegedContainer: true
  allowedCapabilities: null
  apiVersion: v1
  fsGroup: <1>
    type: RunAsAny
  groups: <2>
  
negative.code: - system:serviceaccount:default:registry
  - system:serviceaccount:default:router
  - system:serviceaccount:openshift-infra:build-controller
  volumes:
  - '*'
  ----
  
  <1> The `*FSGroup*` strategy which dictates the allowable values for the
  