Merge pull request #5289 from php-coder/scc_request_privileged_mode

admin_guide/manage_scc: improve the steps for using the privileged SCC

Author: ahardin-rh

admin_guide/manage_scc.adoc

@@ -250,28 +250,30 @@ In some cases, an administrator might want to allow users or groups outside the
 administrator group access to create more _privileged pods_. To do so, you can:
 
 . Determine the user or group you would like to have access to the SCC.
++
+[WARNING]
+====
+Granting access to a user only works when the user directly creates a pod. For
+pods created on behalf of a user, **in most cases** by the system itself, **access
+should be given to a service account** under which related controller is operated
+upon. Examples of resources that create pods on behalf of a user are
+Deployments, StatefulSets, DaemonSets, etc.
+====
 
 . Run:
 +
 ----
 $ oc adm policy add-scc-to-user <scc_name> <user_name>
 $ oc adm policy add-scc-to-group <scc_name> <group_name>
 ----
-
++
 For example, to allow the *e2e-user* access to the *privileged* SCC, run:
-
++
 ----
 $ oc adm policy add-scc-to-user privileged e2e-user
 ----
 
-[WARNING]
-====
-Granting access to a user only works when the user directly creates a pod. For
-pods created on behalf of a user, in most cases by the system itself, access
-should be given to a service account under which related controller is operated
-upon. Examples of resources that create pods on behalf of a user are
-Deployments, StatefulSets, DaemonSets, etc.
-====
+. Modify `SecurityContext` of a container to request a privileged mode.
 
 [[grant-a-service-account-access-to-the-privileged-scc]]
 
@@ -295,6 +297,9 @@ account. To do so, set the `spec.serviceAccountName` field to a service account
 name. Leaving the service account name blank will result in the `default`
 service account being used.
 
+Then, ensure that at least one of the pod's containers is requesting a
+privileged mode in the security context.
+
 [[enable-images-to-run-with-user-in-the-dockerfile]]
 
 === Enable Images to Run with USER in the Dockerfile