diff --git a/modules/security-context-constraints-about.adoc b/modules/security-context-constraints-about.adoc index 09b5b81e8d..3074a8e442 100644 --- a/modules/security-context-constraints-about.adoc +++ b/modules/security-context-constraints-about.adoc @@ -366,16 +366,16 @@ pod to fail. [id="scc-prioritization_{context}"] == Security context constraints prioritization -Security context constraints (SCCs) have a priority field that affects the ordering when attempting to -validate a request by the admission controller. A higher priority -SCC is moved to the front of the set when sorting. When the complete set -of available SCCs are determined they are ordered by: +Security context constraints (SCCs) have a priority field that affects the ordering when attempting to validate a request by the admission controller. -. Highest priority first, nil is considered a 0 priority -. If priorities are equal, the SCCs will be sorted from most restrictive to least restrictive -. If both priorities and restrictions are equal the SCCs will be sorted by name +A priority value of `0` is the lowest possible priority. A nil priority is considered a `0`, or lowest, priority. Higher priority SCCs are moved to the front of the set when sorting. + +When the complete set of available SCCs is determined, the SCCs are ordered in the following manner: + +. The highest priority SCCs are ordered first. +. If the priorities are equal, the SCCs are sorted from most restrictive to least restrictive. +. If both the priorities and restrictions are equal, the SCCs are sorted by name. By default, the `anyuid` SCC granted to cluster administrators is given priority in their SCC set. This allows cluster administrators to run pods as any -user by without specifying a `RunAsUser` on the pod's `SecurityContext`. The -administrator may still specify a `RunAsUser` if they wish. +user by specifying `RunAsUser` in the pod's `SecurityContext`.