openshift/openshift-docs
1
0
Fork 0
mirror of https://github.com/openshift/openshift-docs.git synced 2026-02-05 21:46:22 +01:00
Code Issues Releases Activity

BZ-2008984: Clarifying that 0 is the lowest priority

Browse Source
This commit is contained in:
Andrea Hoffer
2022-11-09 16:49:41 -05:00
committed by openshift-cherrypick-robot
parent b7f45bd114
commit ced90cc99d
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
modules/security-context-constraints-about.adoc
View File

@@ -366,16 +366,16 @@ pod to fail.
[id="scc-prioritization_{context}"]
== Security context constraints prioritization
Security context constraints (SCCs) have a priority field that affects the ordering when attempting to
validate a request by the admission controller. A higher priority
SCC is moved to the front of the set when sorting. When the complete set
of available SCCs are determined they are ordered by:
Security context constraints (SCCs) have a priority field that affects the ordering when attempting to validate a request by the admission controller.
. Highest priority first, nil is considered a 0 priority
. If priorities are equal, the SCCs will be sorted from most restrictive to least restrictive
. If both priorities and restrictions are equal the SCCs will be sorted by name
A priority value of `0` is the lowest possible priority. A nil priority is considered a `0`, or lowest, priority. Higher priority SCCs are moved to the front of the set when sorting.
When the complete set of available SCCs is determined, the SCCs are ordered in the following manner:
. The highest priority SCCs are ordered first.
. If the priorities are equal, the SCCs are sorted from most restrictive to least restrictive.
. If both the priorities and restrictions are equal, the SCCs are sorted by name.
By default, the `anyuid` SCC granted to cluster administrators is given priority
in their SCC set. This allows cluster administrators to run pods as any
user by without specifying a `RunAsUser` on the pod's `SecurityContext`. The
administrator may still specify a `RunAsUser` if they wish.
user by specifying `RunAsUser` in the pod's `SecurityContext`.