@@ -428,9 +428,11 @@ To provide additional capabilities:
428
428
[[modify-cluster-default-behavior]]
429
429
=== Modify Cluster Default Behavior
430
430
431
- To modify your cluster so that it does not pre-allocate UIDs, allows containers
432
- to run as any user, but prevents privileged containers, grant access to the
433
- *anyuid* SCC for everyone:
431
+ When you grant access to the *anyuid* SCC for everyone, your cluster:
432
+
433
+ * Does not pre-allocate UIDs
434
+ * Allows containers to run as any user
435
+ * Prevents privileged containers
434
436
435
437
----
436
438
$ oc adm policy add-scc-to-group anyuid system:authenticated
@@ -452,7 +454,7 @@ affects Kubernetes and {product-title} components, including the web console
452
454
and integrated docker registry. Changes made with these SCCs can cause these
453
455
components to stop functioning.
454
456
455
- Always prefer creating a custom SCC and target it to only specific users or
457
+ Instead, create a custom SCC and target it to only specific users or
456
458
groups. This way potential issues are confined to the affected users or groups
457
459
and do not impact critical cluster components.
458
460
====
@@ -463,7 +465,7 @@ and do not impact critical cluster components.
463
465
464
466
To relax the security in your cluster so that pods are allowed to use the
465
467
`hostPath` volume plug-in without granting everyone access to more privileged
466
- SCCs such as *privileged*, *hostaccess*, or *hostmount-anyuid*, take the
468
+ SCCs such as *privileged*, *hostaccess*, or *hostmount-anyuid*, perform the
467
469
following actions:
468
470
469
471
. xref:creating-new-security-context-constraints[Create a new SCC] named `hostpath`
0 commit comments