anchor.diff:  ====
   ----
   # oc export scc/privileged
  +
   allowHostDirVolumePlugin: true
   allowHostIPC: true
   allowHostNetwork: true
  
positive.code: . Allocating an FSGroup that owns the pod's volumes
  . Configuring allowable supplemental groups
  
  Two SCCs are added to the cluster by default, _privileged_ and _restricted_,
  which are viewable by cluster administrators using the CLI:
  
  ====
  ----
  $ oc get scc
  NAME         PRIV      CAPS      HOSTDIR   SELINUX     RUNASUSER
  privileged   true      []        true      RunAsAny    RunAsAny
  restricted   false     []        false     MustRunAs   MustRunAsRange
  ----
  ====
  
  
negative.code: 
  ==== Understanding pre-allocated values and Security Context Constraints
  
  The admission controller is aware of certain conditions in the security context constraints that trigger it to look up pre-allocated values from a namespace and populate the security context constraint before processing the pod. Each SCC strategy is evaluted indpendently of other strategies, with the pre-allocated (default) values for each policy aggregated to make the final values for the various ids defined in the pod.
  
  The following security context constraints cause the admission controller to look for pre-allocated values:
  
  . A *RunAsUser* strategy of `MustRunAsRange` with no min/max set.  Admission will look for the "openshift.io/sa.scc.uid-range" annotation to populate range fields.
  . An *SELinuxContext* strategy of `MustRunAs` with no level set.  Admission will look for the "openshift.io/sa.scc.mcs" annotation to populate the level.
  . A *FSGroup* strategy of `MustRunAs`.  Admission will look for the "openshift.io/sa.scc.supplemental-groups" annotation.
  . A *SupplementalGroups* strategy of `MustRunAs`.  Admission will look for the "openshift.io/sa.scc.supplemental-groups" annotation.
  
  During the generation phase, the security context provider will default any values that are not specifically set in the pod.  Defaulting is based on the strategy being used:
  
  . *RunAsAny* and *MustRunAsNonRoot* strategies do not provide default values. Thus, if the pod needs a group id this id must be defined in the pod spec.
  . *MustRunAs* (single value) strategies provide a default value which is always used. Thus, even if the pod spec defines its own group id value, the namespace's default group id will also appear in the pod's groups.
  . *MustRunAsRange* and *MustRunAs* (range based) strategies provide the min value of the range. As with a single value `MustRunAs` strategy, the namespace's default group id will always appear in the pod's list of groups.
  If a range based strategy is configurable with multiple ranges it will provide the min value of the first configured range.
  
  [NOTE]
  ====
  *FSGroup* and *SupplementalGroups* strategies will fall back to the "openshift.io/sa.scc.uid-range" annotation if the "openshift.io/sa.scc.supplemental-groups" annotation does not exist on the namespace.  If neither exist the SCC will fail to create.
  ====
  
  [NOTE]
  ====
  By default the annotation based *FSGroup* strategy will configure itself with a single range based on the min value for the annotation.  For example, if your annotation reads `1/3` the *FSGroup* strategy will configure itself with a min and max of 1.  If you would like to allow more groups to be accepted for the FSGroup field you may configure a custom SCC that does not use the annotation.
  ====
  
  [NOTE]
  ====
  The "openshift.io/sa.scc.supplemental-groups" accepts a comma delimited list of blocks in the format of `<start>/<length` or `<start>-<end>`.  The "openshift.io/sa.scc.uid-range" accepts only a single block.
  ====
  