Skip to content

Commit ee3caaa

Browse files
authored
Merge pull request openshift#10162 from kalexand-rh/pr9927
Don't advice to modify default SCCs: text edits
2 parents cf6fbcf + 64410a7 commit ee3caaa

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

admin_guide/manage_scc.adoc

+7-5
Original file line numberDiff line numberDiff line change
@@ -428,9 +428,11 @@ To provide additional capabilities:
428428
[[modify-cluster-default-behavior]]
429429
=== Modify Cluster Default Behavior
430430

431-
To modify your cluster so that it does not pre-allocate UIDs, allows containers
432-
to run as any user, but prevents privileged containers, grant access to the
433-
*anyuid* SCC for everyone:
431+
When you grant access to the *anyuid* SCC for everyone, your cluster:
432+
433+
* Does not pre-allocate UIDs
434+
* Allows containers to run as any user
435+
* Prevents privileged containers
434436

435437
----
436438
$ oc adm policy add-scc-to-group anyuid system:authenticated
@@ -452,7 +454,7 @@ affects Kubernetes and {product-title} components, including the web console
452454
and integrated docker registry. Changes made with these SCCs can cause these
453455
components to stop functioning.
454456
455-
Always prefer creating a custom SCC and target it to only specific users or
457+
Instead, create a custom SCC and target it to only specific users or
456458
groups. This way potential issues are confined to the affected users or groups
457459
and do not impact critical cluster components.
458460
====
@@ -463,7 +465,7 @@ and do not impact critical cluster components.
463465

464466
To relax the security in your cluster so that pods are allowed to use the
465467
`hostPath` volume plug-in without granting everyone access to more privileged
466-
SCCs such as *privileged*, *hostaccess*, or *hostmount-anyuid*, take the
468+
SCCs such as *privileged*, *hostaccess*, or *hostmount-anyuid*, perform the
467469
following actions:
468470

469471
. xref:creating-new-security-context-constraints[Create a new SCC] named `hostpath`

0 commit comments

Comments
 (0)