Skip to content

Commit 6ec4df5

Browse files
committed
BZ-2008984: Clarifying that 0 is the lowest priority
1 parent 5ac9db0 commit 6ec4df5

File tree

1 file changed

+9
-9
lines changed

1 file changed

+9
-9
lines changed

modules/security-context-constraints-about.adoc

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -366,16 +366,16 @@ pod to fail.
366366
[id="scc-prioritization_{context}"]
367367
== Security context constraints prioritization
368368

369-
Security context constraints (SCCs) have a priority field that affects the ordering when attempting to
370-
validate a request by the admission controller. A higher priority
371-
SCC is moved to the front of the set when sorting. When the complete set
372-
of available SCCs are determined they are ordered by:
369+
Security context constraints (SCCs) have a priority field that affects the ordering when attempting to validate a request by the admission controller.
373370

374-
. Highest priority first, nil is considered a 0 priority
375-
. If priorities are equal, the SCCs will be sorted from most restrictive to least restrictive
376-
. If both priorities and restrictions are equal the SCCs will be sorted by name
371+
A priority value of `0` is the lowest possible priority. A nil priority is considered a `0`, or lowest, priority. Higher priority SCCs are moved to the front of the set when sorting.
372+
373+
When the complete set of available SCCs is determined, the SCCs are ordered in the following manner:
374+
375+
. The highest priority SCCs are ordered first.
376+
. If the priorities are equal, the SCCs are sorted from most restrictive to least restrictive.
377+
. If both the priorities and restrictions are equal, the SCCs are sorted by name.
377378

378379
By default, the `anyuid` SCC granted to cluster administrators is given priority
379380
in their SCC set. This allows cluster administrators to run pods as any
380-
user by without specifying a `RunAsUser` on the pod's `SecurityContext`. The
381-
administrator may still specify a `RunAsUser` if they wish.
381+
user by specifying `RunAsUser` in the pod's `SecurityContext`.

0 commit comments

Comments
 (0)