You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/security-context-constraints-about.adoc
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -366,16 +366,16 @@ pod to fail.
366
366
[id="scc-prioritization_{context}"]
367
367
== Security context constraints prioritization
368
368
369
-
Security context constraints (SCCs) have a priority field that affects the ordering when attempting to
370
-
validate a request by the admission controller. A higher priority
371
-
SCC is moved to the front of the set when sorting. When the complete set
372
-
of available SCCs are determined they are ordered by:
369
+
Security context constraints (SCCs) have a priority field that affects the ordering when attempting to validate a request by the admission controller.
373
370
374
-
. Highest priority first, nil is considered a 0 priority
375
-
. If priorities are equal, the SCCs will be sorted from most restrictive to least restrictive
376
-
. If both priorities and restrictions are equal the SCCs will be sorted by name
371
+
A priority value of `0` is the lowest possible priority. A nil priority is considered a `0`, or lowest, priority. Higher priority SCCs are moved to the front of the set when sorting.
372
+
373
+
When the complete set of available SCCs is determined, the SCCs are ordered in the following manner:
374
+
375
+
. The highest priority SCCs are ordered first.
376
+
. If the priorities are equal, the SCCs are sorted from most restrictive to least restrictive.
377
+
. If both the priorities and restrictions are equal, the SCCs are sorted by name.
377
378
378
379
By default, the `anyuid` SCC granted to cluster administrators is given priority
379
380
in their SCC set. This allows cluster administrators to run pods as any
380
-
user by without specifying a `RunAsUser` on the pod's `SecurityContext`. The
381
-
administrator may still specify a `RunAsUser` if they wish.
381
+
user by specifying `RunAsUser` in the pod's `SecurityContext`.
0 commit comments